



hr 


ry z»X'- Wi '?; ■ ■. ' 

. **• • ' ■ : » '- * -V ,. 

• - 

jMMBHiffmi - - ,,: t- 1 


-. -‘ ■-• ' • v^-Mm 

■r- •;• ' r ’ 


»agay 

■ 

r ; ' . • ■ *W*f- 

■ ••■?? • 

fe ■'■■.. ■ A- 'XX- 



A A . A '' - <v -A. r-'-YA 

A,-, , , : >J‘ . 

■ 

AA; .V'.. 1 - iMXX : ' v;A i 






SHUTTLE VEHICLE ALT) MISSION 




SIMULATION REQUIREMENTS REPORT 


• '• 

. 


: A A LS| 

ii • *&, 


, xx . ■ 


VOLUME III 


10 / 20/72 


SA S>" f C v E'V'tv ■>* 

- 

# 




; f • - ' J ’ , \ 




A .5 Ai 


. 

JJT&ii 

' 


K S "A ^aJ 


rajp; jl§ wSm. 

.•■As . ■ 


* V 


„ , ‘ 

• A'i 

v 


'/■ 


- ,*> m' 

< *' /v-L V : 





THE SINGER COMPANY • DEVELOPER 


SINGER 

SIMULATION PRODUCTS 


» •‘■if,. 


AND MANUFACTURER OF THP ■ i UV 

THE LINK TRAINER SINCE 1929 

A: . 


■ L c- ' . ■ . 




S ! :S 88 

a #| 

■ , ::S»f 







-A2 


SHUTTLE VEHICLE AND MISSION 
SIMULATION REQUIREMENTS REPORT 
VOLUME III 

I 

'10/20/72 

* 


*V 


0 i 

44 - 

jf. F . Burke 
Principal Investigator 
SMS Definition Study 


This document is submitted in compliance with 
Line Item No. 2 of the Data Requirements List 
as Type I Data, Contract NAS 9*12836 


SINGER COMPANY 

SIMULATION PRODUCTS' DIVISION 




SHUTTLE VEHICLE AND MISSION 
SIMULATION REQUIREMENTS REPORT 

VOLUME III 


Prepared by : 


. 4 4 L '~ 

J !/ F. Burke 

Principal Investigator 
SMS Definition Study 


Approved by : 


C. Ola sky 

NASA Technical Manager 


Contracting Officer 

This document is submitted in compliance with 
Line Item No. 2 of the Data Requirements List 
as Type I Data, Contract NAS 9-12836 


SINGER COMPANY 

SIMULATION PRODUCTS DIVISION 



- 398 - 


DATE L0/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE 

NO. ^ 

REV. 

BINGHAMTON, NEW YORK 

REP. 

NO. 


PREFACE 


This document is submitted in compliance with Line Item No. 2 of the 
Data Requirements List as Type I Data, Contract NAS9-12836. The documec 
is divided into four volumes for ease of handling. The contents of 
each volume is defined as: 

Volume I: Includes sections entitled Introduction, Mission 

Envelope and Flight Dynamics which correspond to 
Sections 1.0, 2.0 and 3.0 of the Table of Contents. 
Volume II: Includes sections entitled Introduction and Shuttle 

Vehicle Systems which correspond to sections 1.0 and 

4.0 to 4.18 of the Table of Contents. 

Volume III: Includes sections entitled Introduction and Shuttle 

Vehicle Systems which correspond to sections 1.0 and 
4.19 to 4.22 of the Table of Contents. 

Volume IV: Includes sections entitled External Interfaces, Crew 

Prodedures, Crew Station, Visual Cues and Aural 
Cues which correspond to sections 5.0, 6.0, 7.0, 

8.0 and 9.0 of the Table of Contents. 
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1.0 Introduction , 

The objective of the Shuttle Vehicle and Mission Simulation 
Requirements report is to provide to NASA/MSC documentation of the 
requirements for faithful simulation of the Shuttle Vehicle, its 
systems, mission, operations and interfaces. To accomplish this 
objective the report was divided into eight topics which comprehensively 
cover the simulation requirements of the Shuttle mission and vehicle. 

The topics and their main objectives are summarized below. 

Mission Envelope - This topic covers the space and atmospheric 

missions that are envisioned for the Shuttle 
program. The characteristics of each mission 
are described by an analysis of the mission 
phases, trajectory information, timelines 
and operations for nominal and abort condi“ 

■ tions to the extent data was available. 

Orbiter Flight Dynamics - This topic covers the flight regimes 

which the Shuttle vehicle will encounter in 
the accomplishment of its missions. The 
requirements were established in the following 

i 

manner . j 

. s 

The vehicle configurations that must be simu-| 

i 

lated for horizontal and vertical test 
flights, operational space missions, atmospheri 
missions and abort modes were defined. 
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The dynamics requirements were established 
by defining the forces and moments that will 
act on the vehicle during the entire mission 
envelope which include, propulsion, gravity, 
aerodynamic effects, payload effects, docking 
-effects, staging effects, ground reactions 
and the dumping of material overboard. The 
translational equations of motion requirements 
were established by defining the vehicles, 

~ satellites and payloads whose state vectors 

must be calculated and by defining the co- 
ordinate systems, relative equations of 

, , motion and accuracy of the calculations. A 

similar analysis was performed for the rota- 
tional equations of motion. Mass property 
and ephemeris requirements were also identi- 
fied. 

Shuttle Vehicle Systems - The Shuttle vehicle systems required 

for simulation were identified and described. 

The descriptive data generated in this effort! 

! 

was primarily based on the North American 

! 

Shuttle proposal. The Shuttle vehicle and it|s 
system configuration is currently in a state 
of flux and therefore the descriptive data 
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contained in this report undoubtedly will 
become out of date as: the Shuttle program 
progresses. However, for the purposes of 
this study, the data is more than adequate 
to define simulator requirements and a base- 
line design when it -is tempered with the past 
experience of Apollo and Gemini programs. A 
cross correlation between the NR definition 
of systems and LRU's and this report is shown 
in Table 1-1 for reference purposes. 

External Interfaces - The external interfaces of the Shuttle 

vehicle were identified and a preliminary 
type interface description established. Due 
to the fact that for every external interface 
there also exists an equivalent on-board 
system, the descriptive data on the workings 
of the interfaces is contained in the Shuttle 
Vehicle Systems section of the report and 

cross references are provided in this sectior . 

! 

Crew Procedures - The actual crew procedures for the Shuttle j 

i 

system will not be available for many years. | 
As a result the study concentrated on identi- 
fying tasks by mission phase and crew member 
and identifying the probable interfaces be- 
tween work stations. The data used for the 
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Crew Station 


Visual Cues 


analysis was a RTOP study by MacDonald- 
Douglas, conversations with George Franklin 
of NASA/MSC, past experience, and the re- 
quirements of the Shuttle vehicle & mission. 
The latest available data at the time of the 
■writing of this report was used to identify 
the configuration of the Crew Station. The 
shape of the interior cabin, the location of 
the work stations and the allocation of the 
C&D panels by work station were established. 
Detailed data on the interior composition of 
the cabin is not currently available. 

However, simulation requirements were identi- 
fied based on past experience and accepted 
levels of fidelity for mission simulators. 

The visual scene content was established for 
each of the mission phases. Attributes of 
the scene elements, to the extent feasible, 
were established and will be further defined 
in the SMSR report. The vehicle window con- i 

i 

figuration is not defined at this time but 
the best data available was utilized. The 
accelerations, velocites and displacements 
were established to the extent possible. Sonj 
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4.19 Modular Display Electronics (MDE) 

4.19.1 General Function 

The Modular Display Electronics (MDE) equipments in the 
Space Shuttle are a part of the Data Processing and Software 
Subsystem. The six associated cathode ray tube (CRT) displays 
and keyboards supplement primary instruments for GN&C computer 
data entry and readout and are also used for backup guidance ...... 

and subsystem status. 

The MDE concept was developed to satisfy two basic needs: 
(1) provide separation of routine display functions from critical 
GN&C computer control functions, and (2) provide data processing 
capabilities over and above GN&C computers for both management 
simplification and avoidance of systematic errors. A standard- 
ized CRT /Keyboard interface results from this approach and system 
growth can be more easily accommodated. A simplified block 

. S . . . _ ' . _ _ 

diagram is shown in Figure 4..19-.1-1. 

1 ’ • : \ 

Figure 4.19.1-1 is a more detailed block diagram showing 

. - • * 

the evolution of the MDE concept. 
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Ll 
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Figure 4.19.1-1 
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Four MDE's are used in the baseline system to provide 
GN&C Display /Keyboard interfaces, performance monitor, and back 
up guidance display processing. Three MDE's are interconnected 
with GN&C computers to provide prime GN&C display and control 
capability on any combination of the three forward CRT's/Key- 
boards. Backup guidance displays are normally presented on the 
center CRT and performance monitoring page formats on the aft 
CRT. All MDE's are tape cartridge reloadable in non-time criti 
cal periods. Refer to Figure 4.19 -3. 

Significant hardware and software growth capability 
is available through the addition of two PMS computers (same 
type as GN&C computer) and using MDE 3 and 4 in the same 
relationship as MDE 1 and 2 to GN&C computers. Two additional 
MDE's are used in the payload system for a total of six in the 
Orbiter vehicle. 


J 
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’ 

Subsystem Management 




Onboard and ground data/control relationships shown (Fig .4 *20 .1-4) ! 


illustrate how all data users have access to the same data. 

Up to four unique formats are available in the stored program 
PCM master unit to accommodate user unique requirements. Tape 
reload capability for MDE's is available during flight, but is 
used only in non-time-critical situations. A prerecorded PCM 
track is available on the PCM recorder for end-to-end ground 
self test of the MDE/CRT /Annunciator combinations. Continuous 
self monitoring of the PCM subsystem is accomplished through the 
«se of standard analog and digital words generated within the 
remote units. 

. . . .. V'-'.:. i Figure 4 .19. .1-4 

SUBSYSTEM MANAGEMENT 
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4.19.2 MDE System Operation and Interfaces 

Processing of data for display on the subsystem CRT and for 
subsystem performance and operation monitoring is accomplished by MDE 
Subsystem Display Processor set which includes a modular, serial-output, 
address-programmable PCM data selector /buffer , a small stored-program 
processor CPU-I/O, and lamp driving logic. The equipment interfaces 
with the composite PCM stream, with an alphanumeric display/keyboard 
set which has been loaded with format skeletons for subsystem display, 
and with a number of fault status and agree /disagree annunciators lo- 
cated on the subsystem panels. There is also an interface with the 
vehicle Caution & Warning system for use in sleep periods or at times 
when the subsystem panels are unattended. Functional organization of 
the equipment is shown in Figure 4.19.1-2. 

4.19.2.1 Display Unit (DU) 

The unit employs a small (4x4 inches usable) , high- 
brightness CRT to present up to 18 line of 24 alphanumeric characters 
each. Located on the DU bezel are 16 line designator pushbuttons used 
in conjunction with the keyboard for display selection and data entry. 
The face of the DU, with a. typical GN&C format displayed, is shown in 
Figure 4.19.2-1. The top line of the format is normally used for page j 
titles and numbers; lines 1 through 16 . for data names, data and units ; .j 
and the bottom line is reserved for keyboard data entry and verifi- j 
cation, and for computer error messages. 
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Figure 4.19.2-1 Alphanumeric Display CRT 


i 
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4.19*2.2 Keyboard 

A 4 x 8 key matrix is used to control the CRT display , select 


index and data pages, and communicate with the interfacing computer. 

The standard keys -are zero through 9, + , -, Decimal Point, Enter, Resume, 
Proceed, End, and Clear. The remaining function keys are reformattable 
for flight and subsystem display applications. See Figure 4,. 19. 2-2. 

1 7 

System Operation 

The Display /Keyboard set operates in two basic modes, an 
index mode and a data mode. Index mode operation is initiated through 
actuation of an INDEX key on the keyboard; initially the top index page 
is called from a fixed location in MDE memory and displayed. Each line 
on this page represents either a sub index page or a data page. A one- 
selection may then be made by pushing the line selector 
push-button opposite the desired page title. Alternatively, data pages 
may be called directly by page number from the keyboard by actuating 
a PAGE SELECT key, or may be paged through consecutively. When data 
page selection made via the index tree, the display shifts to data 
mode as soon as a specific data page is selected. In the data mode, the 
MDE assembles a data page from a fixed skeleton called from a selected 

MDE memory location and variable data requested from the selected inter- 

\ 

facing computer. The request to the computer is identified by data page! 

| 

number, which is decoded in the computer to initiate routines which ! 
select and convert constants from memory and results of on-going compu- 
tations, and assemble this data in line order for transmission to the 
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CRT. This cycle is repeated twice per second for update. The page 
number is sent with each update block and compared with the called page 
number in the MDE to assure data/format skeleton compatibility. By a 
combination of field masking techniques and special instructions, the 
average alphanumeric data page skeleton occupies less than 120 16-bit 
words in MDE memory and requires approximately 30 16-bit words of data 
from the computer for a full page update. 

Actuation of the numeric and sign keys on the keyboard when 
in the data mode is interpreted as a data entry to the computer. The 
data goes into a buffer line in MDE memory and comes up on the bottom 
scratchpad line on the display as it is entered; the interfacing compu- 
ter does not take cognizance of the data until it has been inspected, 
its disposition identified by a discrete from one of the display line 
selector buttons, and the ENTER key actuated. The computer then 
evaluates the entered data for acceptability. If the data is acceptable, 
the computer clears the scratchpad line and substitutes the entered 
value for the value in its memory, causing the same number to appear 
in the selected data line on the next update. If the data is unaccepta- 
ble (not a program constant, wrong value, no disposition, etc.) the 

... - i 

i 

computer sends a discrete to light an OPERATOR ERROR annunciator and j 

i 

an error code to initiate display of an error message on the scratchpad | 

i 

l 

line. If during the execution of programs the computer encounters 
problems, it can light a PROGRAM ALARM annunciator and send an error 
code to initiate display of an error message on the scratchpad line. 
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The keyboard has priority in that error messages will not be forced- 
displayed while keyboard entry is in process, but will come up if the 
operator clears the scratchpad line. Error messages are stored in the 
MDE memory and addressed by conversion of error codes into memory 
locations. 

4 .19.2 .3 IOB Adapter ' 

T-he MDE is capable of interfacing with any of three computers, 
one at a time. The IOB Adapter, therefore, contains the driver and 
receiver circuits required to send and accept signals from 3 computers. 
The selection of the one active computer interface is based upon dis- 
crete signals received in the MDE from a panel control switch. The com- 
puter selection logic samples the selection control discretes and 
electrically ties the active computer interface to the remaining MDE 
logic. 

Operation of a function key on the keyboard, such as enter, 
end, proceed, clear, etc., causes the MDE computer to initiate a command 
or a data transfer. The computer will first issue a read-I/O address 
command which causes the MDE to transfer the memory address where the 
last encoded key action is stored. (Keyboard entries, including line/ 

column select, are stored sequentially in a fixed portion of the MDE j 

* 

core memory.) By performing a subtraction, the computer then initiates 
read commands to the MDE beginning at the start of keyboard entry 
storage up to the last entry which initiated the transfer. The computer 
then issues a write command to reset the keyboard entry table to blanks. 
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This has the effect of clearing line 17 the scratch pad line. The com- 
puter then operates upon the operator request. 

The Computer IOB Adapter contains the logic required to 
communicate with the selected computer. It is capable of responding 
to read or write commands issued by the computer. It is also capable of 
generating an interrupt to the computer when commanded to initiate a 
transfer . 

4.19 .2.4 Keyboard Adapter 

The Keyboard Adapter receives parallel data from the keyboard 
which is encoded to define which of the keys on the keyboard or display 
unit has been depressed. The keyboard initiates data transfers by 
raising a request line to indicate that a key has been pressed. The 
Keyboard Adapter acknowledges the keyboard input and then stores the data 
in the MDE memory. 

For computer-destined data, the KA notifies the I/O Multiplex 
which interrupts the computer and requests a read of the desired data. 

An area in the MDE computer memory is reserved for keyboard service data. 
For this data, the computer does a special formatting operation for 
processing and display on the data entry (scratchpad) line. If the 
Enter Key is depressed, indicating that the scratchpad line should be 
sent to the computer, the computer reads the scratchpad locations in i 
MDE memory and then clears them. This has the effect of transferring 
the data from the scratchpad line to the selected data line. The 
scratchpad line can also be cleared from the keyboard. 
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4 .19;. 2. 5 Symbol Generator 

The Symbol Generator is comprised of digital and analog 


circuitry which controls the presentation of display formats. It is 
used to generate alphanumeric characters. The refresh and generation 
of the symbols are controlled by a list of instruction words which are 
stored in the MDE core storage. The digital instruction words are 
processed by. converting them to the x-deflection, y-deflection, and z- 
axis video signals required to drive the CRT display. 

The Symbol Generator provides the following display 
capabilities: 

Generate alphanumeric characters from stroke information 
stored in the MDE memory. 

Format characters in type mode or random positions. 

. Growth capability for drawing vectors of any length. 

Position characters at any location on a 512 by 512 matrix. 
Present a uniform display by controlling the intensity of 
the characters (and vectors). 

. Operate in a typewriter mode associated with either the 

X or Y direction. ■ - • -- . - 

4.19.2.6 PCM Adapter j 

i 

This element accepts a Manchester biphase coded data stream j 

i 

at rates up to 100 KB/S, strips sync from the stream to provide frame I 
and word sync and bit clock, and sequentially selects, buffers and 
transmits RZ-coded logic-level data to the processor. Both the incoming 
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PCM address and the outgoing data are buffered for at least one PCM 
word interval in order that contiguous words in the stream may be 
selected. 

4.19 .2.7 Processor CPU ~ I/O 

The processor is a low-cost general-purpose, high-speed, core- 
.memory .machine which basically executes four tasks: data selection, 

display scaling, data limit checking and system self-test. The memory 
is modular up to 16K, 16-bit words. The processor retains in its re- 
loadable memory the PCM address tables for selection of up to 1,000 
measurement; the denormalizing constant tables for scaling of up to 
1,000 measurements for display, together with the display address tables 
for up to 50 12-line tabular alphanumeric CRT display pages; the pre- 
determined operating limits for limit-checking and logic comparison of 
up to 600 analog and discrete measurements, together with annunciator 
address tables for up to 150 fault status annunciators; and the program 
to accomplish the four tasks defined above. The limit-checking operation 
may apply up to three selectable sets of limits to monitored measure- 
ments, depending on subsystem configuration and/or mission phase. 

Further details are to be found in Section 4.^19. 3 and 419- .4. 

4-19-2.8 Lamp Buffer Adapter j 

*i - i 

This electronics accepts and decodes outputs words from the | 

! 

CPU to determine which of the fault status annunciators should be 
activated. A provision is incorporated to hold annunciators activated__ 
until acknowledged by the crew. The decoded and processed discretes 
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are outputted to the annunciators via lamp drivers to provide the 
required power switching. 

, 

4 ., 1.9.2 .9 System Operation 

’ 

CRT displays are requested by index tree or page number via 

the keyboard as described in section 4-19.2.1. In either case the page 

- ; 

number code is decoded by the processor to access the appropriate 
denormal izing constant and display address tables for the selected page. 
The processor then addresses and selects the requested data, converts 
the data and the PCM frame time into BCD-coded engineering units format, 
assembles it in display line order and transmits it to the display set a 
described previously. This operation is repeated an integral number 
of PCM frames later for update; the number is selectable to achieve 
a nominal twice-per-second update with either real-time or tape-delayed 
non-real-time input data. , 

Measurement selection for limit-checking will be established 
by a predefined PCM address table. The processor will select from its 
memory the appropriate limit and status tables for the selected 
operational phase and subsystem configuration, and will ordinarily make 
a limit check or a state comparison for all selected measurements. 
However, if a known off-nominal measurement repeatedly triggers the 

i 

alarm, the processor can be instructed via the keyboard to disregard 
the condition of that measurement until it is notified to the contrary, i 
The processor will maintain a table of inhibited measurements for 
display upon request. 1 
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Limit checking can be done at repetition rates up to about 
10 per second. However, the processor will normally be instructed to 
verify that an off-nominal condition persists for a number of consecutive 
data samples (2 to 5 for most measurements) before outputting an alarm 
discrete. When an off-nominal condition is verified, the processor 
wiil output •discrefce-s .to .the .annunciator logic identifying the appro- 
priate individual fault status annunciator, and to the master fault 
annunciator, and will write the number of the display page containing the 
offending measurement (s) on the scratchpad line. If the appropriate 
display page is up, or when it is brought up, the processor will 
identify the data it has evaluated as off-nominal by requesting a "bug” 
symbol on the appropriate display line which will flag the measurement (s) 
as out-of-tolerance high or low. A performance monitor status table 
will be maintained, to be displayed in page format on request, listing 
in chronological order the measurements which have been abnormal since 
the table was last cleared and indicating what that status was (high, 
low, off, failedv-etc .) . 

In each major cycle of processing for display and performance 
monitor, the Processor executes a routine whicji checks the data, the 

I 

system hardware, and itself. A BITE annunciator is provided which is j 

i . 

normally held off by a pulse train from the Processor I/O. However, 
should the PCM data fail, or a check of calibration words or PMC BITE 
discretes from the data stream indicate "no-go", or the processor self- 
test routine indicate "no-go", or the processor power fail, the output 
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pulse train will cease and the BITE annunciator will illuminate. If 
the processor itself is still healthy, it will send an error code to 
the display set to initiate display of an error message identifying 
the problem. 



i 
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4.19.3 MDE Computers •• 

There are presently two different computers being used for the 
MDE CPU application. For the non GN&C Performance Monitoring applica- 
tion, two IBM Model APlOl's will be used. A detailed description of 
this computer is to be found in section 4.18.3. For the GN&C MDE ' s 
and 'for the "Payload 'System ’MDE' s , smaTl IBM type SP-1 computer is to 
be used. A detailed description of this computer follows. 
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4. 193 MDE Computer Type SP-1 


Machine 

Organization 


Type 

Number System 
Operation 
Data Word Length 
Instruction Word 
Length 
■Number.of 
Instructions 
Typical Execution 
Times 
Add 

Multiply 

Divide 

Average Instruction 
Execution Rate 
Registers 


General purpose, stored program, simplex 
Binary, fixed point, two’s complement, fractional 
Full parallel (16 bits) 

16-bit word, including sign; 32-bit doubleword, including sign 
16 bits . 


2.7 /is 

5.7 /is 

8.0 ns 

350.000 operations/ second 

4 (A, Q, and B registers and instruction counter) 


Main 

Storage 


Type 

Capacity * 

Modularity 
Cycle Time 
Access Time 
Special Features 


Ferrite magnetic core, nonvolatile, random access, destructive readout 
4096; 8 1 92; 1 2,288; or 1 6,334 1 7-bit words 
4096 17-bit words per pluggable module 
1.33 #rs (write or read/restore) 

600 ns 

Power transient protection, separate sense winding, 2-1/2D organization, 
temperature compensation 


I/O Parallel 
Channel 


Logic 

Circuits 


Power 

System 


Physical 


Externally Initiated 
Program Initiated 
Data Interface 
Maximum Data 
Transfer Rate 


Class 

Type 

Package 


Primary Power 


Output Regulated 
DC 

Features 


Volume 

Weight 

Construction 

Cooling 

Environment 


Direct memory access; buffered I/O 
Direct I/O 

16 bits plus address and control; single-ended TTL interface 
150,000 to 600,000 words/ secono 


Monolithic integrated 

Transistor/transistor logic (TTL) and medium-scale integration (MSI) 
Flatpacks: 14, 16, and 24 leads * 


115/200 V AC, 3-phase, 400 Hz, 72 W average for standard structure, 
31 to 52 W for basic assembly (28 V DC primary input power 
optional) - 

+5, -5, +12 V DC 

Overvoltage and overcurrent protection, transient protection, power 
sequencing pluggable modular construction 


Standard Structure 
0.35 ft 3 

18.1 lb, for 4K storage 

21.7 lb, for 16K storage 

Plug-in modules used throughout 

Indirect air. conductive 

Meets or exceeds MIL E-5400, Class 2X 


Basic Assembly 
0.06 ft 3 

3.6 lb, for 4K storage 
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System 

Test 

Set (ACE) 


System Reset -5-5-12 
• VOC 


.Parity Error 



A'JE - Aerospace Ground 
Equipment 

SAR • Storage Address Register 
SOR • Storage Data Register 


Externally Controlled 

Oirect Memory Access (DMA) 

Buffered I - O 

Interrupt 

Program Controlled 
Direct I O 


115/200 VAC 
3o. 400 Hi 
(or 28 V DC) 


Figure 4*19 .3-1 
Computer Block Diagram 
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Central Processing Unit 


The central processing unit (CPU) 
contains the logic necessary to 
fetch, decode, and execute instruc- 
tions and to perform the necessary 
arithmetic, logical, and other data- 
processing operations. All opera- 
tions are full 16-bit parallel, with 
a basic cycle time of 333 nano- 
seconds. Sixteen-bit parallel in- 
terfaces are provided for the I/O 
module, main storage, computer 
memory loader/verifier, and op- 
erator control panel. 

Instruction Format 
An extensive sot of instructions 
is provided for arithmetic, logi- 
cal, branching, data moving, and 
I/O operations. Double-precision 
add and subtract, together with 
the multiply and divide opera- v 
tions, provide for supporting ex- 
tended precision applications. 

A 16-bit instruction format is used 
to combine storage efficiency and 
powerful addressing capability. 
Direct, indirect, relative, and im- 
mediate addressing modes are pro- 
vided in the short format (SRS) 
instruction. 


6 V 

I ! 


The B field specifies whether or 
not the base register is used during 
address generation. The M field 
specifies the addressing mode to 
be used. Direct mode addresses 
ne first 512 locations in main 
storage. Relative mode provides 
an address displacement with re 
spect to either the instruction 
sounter or the base register (B). 


The 16-bit immediate operand is 
formed from the B field (bits 0 
through 7 of the operand) and ' 
the displacement field (bits-8 
through 15 of the operand). 

Indirect addressing is provided in 
two formats: 

• Indirect 

’ Indirect and Tally. 

Indirect addressing permits full 
address specification without al- 
tering the base register. Also, in- 
direct addresses may be shared by 
several instructions, thus conserv- 
ing storage. The Indirect and Tally 
addressing mode automatically in- 
crements the indirect address word 
following each use, providing the 
programmer with excellent index- 
ing and data array*manipulation 
potential. 


Execution 


Instruction 


Arithmetic 


Execution 
Times (ps) 


Add 

Add Double 
Subtract 
Subtract Double 
Add to Storage 
Tally (Skip if zero) 
Tally I/O 
Multiply 
Divide 


Instruction 

Times (ps) 

Logical 

Compare High 

2.7 


Compare Low 

2.7 


Compare Equal 

2.7 


AND 

2.7 


AND to Storage 

3.0 


OR 

2.7 


Exclusive OR 

2.7 

Branch 

Exclusive OR to Storage 
Branch Out 

3.0 


Unconditional 

1.7 


Branch Unconditional 

1.7 


Branch on A Negative 

1.7 


Branch on A Zero 

1.7 


Branch and Link 

4.0 

Data 

Load A 

2.7 

Move 

Store A 

3.0 


Load Base 

2.7 


Store Base 

3.0 


Modify Base 

2.7 


Load Q 

2.7 


Store Q 

3.0 

Register 

Reset Interface 

1.7 

Operations Base to A 

1.7 


A to Base 
Shift A Right 

1.7 


Arithmetic 

1.7+ * 


Shift A Left Logical 
Shift A, Q Right 

1.7'+* 


Arithmetic 

1.7+ 


Shift A, Q Left Logical 

1.7+ * 


BITE Failure 

1.7 

Input/ 

In Service 

3.0 

Output 

Out Service 

2.7 


Direct In 

2.7 


Direct Out 

2.7 1 


'Shift length (ri): add rt/6 if shift even; 
(n+3)/6. if odd. 
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Input /Out put 


A fast'parallel channel interacts 
with the high-speed CPU and main 
storage to provide excellent 
throughput and to feature perfor- 
mance, operation, and an I/O in- 
terface that are upward-compatible 
with other System/4 Pi machines, 
.such-as-the IBM AP-1. computer. 

Three I/O modes are provided for 
the transfer of data and command 
functions between the SP-1 com- 
puter and peripheral equipment: 


• Direct Memory Access (DMA) 

I/O — The I/O device provides a 
16-bit main storage address; 16 
bits of data are written into or 
read from this storage location. 
The DMA I/O mode is initiated 
by the I/O device. A CPU lock- 
-out-feature significantly increases 
the data transfer rate, providing 
a maximum data transfer rate of 
600,000 words per second. 

•Buffered I/O — The I/O device 
provides an "address tag," used 
to access a channel control word 
(CCW) containing count and ad- 
dress; a single data word or a 
block of data words is written 
into or read from main storage. 
The Buffered I/O mode is initiated 
by the I/O device. A maximum 
data transfer rate of 175,000 
words per second may be reached 
when the CPU is locked out. 


Direct I/O,— Under control of the 
CPU instruction stream, a com- 
mand is sent to an I/O device, and 
one 16-bit word of data is written 
into or read from the device. The 
Direct I/O mode is initiated by the 
program. The data transfer rate is 
a function of the operation fol- 
lowing the transfer and may be as 
high as 175,000 words per second. 

In addition, an external interrupt 
is provided, allowing external 
equipment to cause the CPU to 
suspend current operations, store 
the current contents of the in- 
struction counter, and load a new 
instruction count from the storage 
locations specified by the I/O de- 
vice. The I/O device provides the 
interrupt service routine address, 
permitting the support of multiple 
interrupts. The I/O device also 
implements any priorities required. 


Parallel 

Channel 


Externally Initiated 


Direct Memory Access: 600,000 words/s (maximum) 
Buffered I/O: 175,000 words/s (maximum) 


Program Initiated 


Direct I/O: 175,000 words/s (maximum) 


Data Interface 


16 bits plus address and control; single-epded TTL interface 


Maximum Data 
Transfer Rate 


150,000 to 600,000 words/s 


One external interrupt line (multiple interrupts may be handled) 
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I/O Interface 

The interface between the I/O 
channel and I/O devices is shown 
in the accompanying illustration. 
Each I/O device has unique Service 
Request and Service Acknowledge 
lines. Two. pairs of these lines are 
built into the standard CPU and 
I/O logic pages, supporting two 
devices. More lines may be added 
on the custom I/O page if support 
for additional I/O devices is de- 
sired. The interface lines are im- 
plemented in standard TTL logic. 

Either a single peripheral I/O de- 
vice or a control unit may be at- 
tached to the I/O interface. Each 
control unit, addressed and con- 
trolled by a channel control word - 
(CCW), may interface with as 
many as 127 peripheral I/O de- 
vices. 



Oata Out Bus 
Zero Count 

> Branch Out 

■> Command Out 

> Oata Acknowledge 

Oata In Bus 
Input 

Direct Memory Access 
External Interrupt 
Data Request 
Lockout 
System Reset 

Service Request 
Service Acknowledge 
i> 750 kHz Clock 


Figure 4 . 19.3-2 
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SP-1 Computer 
Support Software 

The SP-1 Support Programming 
System (SPS) provides the appli- 
cation programmer with a set of 
aids designed to effectively reduce 
the time required to get the appli- 
cation programs online and to 
support program modifications 
and maintenance. Continuing a 
field-proven concept, the SP-1 • 

SPS provides the user with an as- 
sembler, a linkage editor, and a 
simulator program: 

> Assembler — Uses an efficient 
symbolic language. Allows mod- 
ular programming and testing. 
Assembles relocatable programs. 
Provides syntax error detection 
and identification. Allows macro- 
processing and conditional assem- 
bly. Produces listed output. 

* Linkage Editor — Combines and 
relocates program modules as- 
sembled at separate times. Re- 
solves program linkages. Creates 
input for the simulator. Creates 
core image object programs for 
loading SP-1 computer storage. 

•Simulator — Allows SP-1 program 
analysis. Facilitates dynamic sim- 
ulation through a user-written con- 
trol program. Provides user access 
to simulated computer object pro- 
gram data (with absolute and sym- 
bolic reference). Allows object 
program correction. Provides pro- 
gram debugging options (dump, 
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The SP-1 assembler gives the pro- 
grammer a symbolic source lan- 
guage that produces storage-effi- 
cient, high-throughput programs 
using the effective instruction set 
defined by the computer architec- 
ture. An excellent macroprogram 
capability significantly reduces the 
repetitive coding required of the 
application programmer. 

Identical in most respects to the 
widespread, well known System/ 
360 assembly language, the SP-1 
assembler requires minimum re- 
training of experienced program- 
mers and provides early online re- 
lease of new trainees, thus signifi- 
cantly reducing training costs. 
High-quality user and programmer 
manuals assist programmers in the 
effective use of the SP-1 assembler 
language. Programming rules and 
techniques, such as modular pro- 
gramming (C-sects, D-sects, etc.), 
syntax, macroprogram generation, 
symbols and labels, source instruc- 
tions, comments and continuation 
lines, and subroutine linkage, are 
in most cases identical to System/ 
360 operations. 
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The linkage editor is used to com- 
bine object program modules into 
a core image load module for the 
SP-1 and to resolve all necessary 
program linkages. The linkage 
editor input to the SP-1 simulator 
program includes not only the core 
image load module, but symbolic 
reference data as well. 

The simulator dynamically ana- 
lyzes the SP-1 program modules 
at the instruction word level and 
executes any given set of SP-1 in- 
structions prepared by the linkage 
editor. Facilities such as dumps, 
traces, and snaps are available 
under the control of a user-written 
simulation control program. 


snap, trace). Enables simulation 
of I/O and interrupt initiation and 
response. 









F -398- 8 • 



THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

BINGHAMTON. NEW YORK 



Option Summary 


Two major options are available 
for extending the capability and 
adaptability of the SP-V computer: 

♦ Expanded Main Storage - The 
minimum configuration SP-1 com- 
puter has a 4K-word main storage,. 
Storage may be expanded in 4K 
increments to 3 6K words by in- 
serting additional pluggable 4K 
storage pages into the structure. 
Self-contained timing and storage 
logic require no changes to the 
CPU and interface design. This 
modification can be installed in 
the field. 

•Custom I/O — Space is provided, 
and the necessary control signals 
and data buses are included, for 
the insertion of a custom I/O 
module, individually designed to 
meet application requirements not 
covered by the standard broad-use, 
high-speed parallel channel. 
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4.19.4 MDE Software and Systems Applications 
4 . 19 . 4 . 1 MDE Computer Software 


Software shall be provided to execute in the MDE Computers 
and shall perform the following functions: 

Limit check analog parameters 
Verify correct discrete status 

Communicate results of the above two functions to CRT 
and panel annunciators. 

I » 

Display crew selected subsystem status formats on CRT. 

The combination of the above software functions along with 
the assumed hardware configuration will allow the crew to verify and 
make judgments as to subsystem status. 

The software shall consist of a minimal control program, 
limit checking routines, display support routines and tables. Addi- 
tionally, predefined format skeletons shall be supplied. 

MDE Processor Control Program 

The control program for the MDE processor schedules the 
processor software tasks for execution during a predefined fixed time 
slice processing cycle occurring every TBD ms, pr at a preselected 

integral PCM frame count.. The MDE processor cycle is shown in. 


I 








date 10/20/72 

1 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-335 

REV. 

BINGHAMTON. NEW YORK 

REP. NO. 


Figure 4.19-8. Two control program subprograms, cycle control and 
data input, are executed prior to dispatching the performance monitor 
and display processing applications programs. Execution of data output 
and self-check subprograms complete this cycle. The control program 
subprograms are discussed in the following paragraphs: 

1 . "Cycle Control - The -eyerie control function determine 
major cycle timing. It is presently planned that the occurrence of 
PCM master frames will be counted and that the processing cycle will 
be entered after that count reaches a value of two (a measurement 
sample rate and program iteration rate of 2 /second was assumed for 
sizing purposes) . The counter (or clock) is reset immediately 
before the major cycle is entered. 

2. Data Input - Data input processing consists of 
initiating an I/O sequence to read the required PCM measurements into 
the processor main storage. Discrete measurements are assumed to be 

1 bit each, and analog measurements are assumed to be 8 bits each. 

For sizing purposes, it was assumed that 300 analog and 300 discrete 
measurements are obtained for non GN&C performance monitor and display 
processing. =• 

3. Data Output - The data output subprogram transfers the 
display update data to the MDE and transfers on/off signals to the 
subsystem annunciators as determined by the performance monitor softwar 
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MDE and annunciator output lists are generated by the display processin, 
and performance monitor application programs, respectively. These list 
are processed by the control program to effect data output. 

4. Self-Check - The self-check subprogram is executed as 
the last task in each processing cycle. Main storage, internal CPU, 

.and ..I/O functions are tested . .Anomalies detected by self-check are 
communicated by an external discrete indication and/or an error code to 
the MDE . 
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4.19.4.2 GN&C MDE System Application 
4 . 19 . 4 . 2 . 1 GN&C Display Systems Software 


The Display subprogram in the GN&C MDE computers provides the 
capability to selectively support specific crew requested displays. Thi 
support includes arithmetic conversion, BCD conversion, formatting and 
transmission of GN&C data to the crew station displays. For output data 
“fche- •dis’play ^support -software -ha-s -the capability to process one parameter 
per line for twelve lines on each of fifty pages. In addition, the 
display software also processes input data passed from the crew station 
to the GN&C MDE computers via an alphanumeric keyboard. The processing 
of the input data includes interpretation, conversion, limit testing 
and reasonableness testing. The input processing function is capable 
of processing 100 parameters. The display system subprogram is capable 
of generating alphanumeric display messages and a vector symbol genera- 
tion. 

1. Display System Subprogram . The Display System Software 
performs the function of presenting the Oribter GN&C system status infor 
raation to the crew via a combination CRT and keyboard (DSKY) displays. 
The DSKY consists of numeric and special character keys which the crew 
will use to communicate with the Display subprogram. The CRT display 
will accommodate 18 lines of alphanumeric data with 24 characters per j 

: i 

data line. The 18 lines of data are dedicated to 1 title line, 

16 measurement data lines, and 1 scratch pad line. Fifty CRT page 
formats, each containing 16 lines of data , are required to accommodate 
the GN&C display requirements. 
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2. Page Formats . The 24 characters for each of the 16 
measurement lines is subdivided into a group of 12 characters for 
measurement identification, 5 characters (including decimal point) for 
data, 4 characters for units, and 3 blank separator characters. The 
page skeleton information containing the page title, measurement ID's 
and units is contained in the MDE computer memory. The MDE memory 
contains 8 K,* 16 bit words. The memory required to perform data display 
calculations is included in the GN&C Display program. 

3. Display Selection . The keyboards are each redundant. 

Data entered on each DSKY is directed toward each of the 3 GN&C compu- 
ters simultaneously - so that all programs receive the same input data. 
Either display can be switched to read the outputs of any one of the 

3 GN&C computers. The program structure is designed such that a 
different page of display data can be directed toward each of the CRT 
displays. Each DSKY can be coded to direct either a common or a unique 
display to each of the CRT displays. 

As data is entered on the DSKY, the MDE will interrogate 
the DSKY and display the keyed data on the scratch pad line of the CRT 
display. The program will not react to keyed data requests until the 
ENTER button is depressed. j 

.... i 

4. Input Data Checks . The- program will perform input data 
tests on a selected set of DSKY input data. The tests will attempt to ! 
insure that erroneous or unrealistic data is not accepted by the 
program. In the event of a failure of the input data tests, the prograrr 
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will notify the crew of the failure condition and will not act on the 
entered data. The crew has the option of overriding the test results 
and forcing the program to accept the data. The input data checks in- 
clude 50 limit tests and 50 reasonablesness tests. 

5. Display Types . The program will provide for 50 unique 
data page displays where each data page contains 12 system measurements, 

1 title line and 1 scratch pad line. The 50 display pages are further 
defined as follows: 

(a) 15 Systems Status Display Pages - To provide for 
125 GN&C system measurements including 40 analog, 60 discrete and 25 
system status measurements. 

(b) 35 Parametric Data Displays - To provide a capability 
for displaying approximately 400 measurements, internal computer calcu- 
lations, or program constants. The 400 lines of parametric display 

data are not presently defined. 

6. Failure Indications . Any system failures detected by 

the GN&C Flight program will be presented to the crew via a caution and 
warning indication in addition to a failure message on the scratch pad 
line of the CRT display. The scratch pad line will inform the crew of 
the failure type and present a page number to be entered via the j 

keyboard to obtain a full set of CRT display data for the failed sub- 

, I 

system. Multiple failure indications will be provided for by the j 


program 
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4. 19. 4. 2. 2 GN&C Performing Monitoring Software 

/ 

1. Analog Processing - A Performance Monitor module will be 
provided to verify that all GN&C system analog parameters are within a 
predefined set of high/low limits. An out-of-tolerance condition will 
cause notification to be made to the crew via subsystem annunciators 
..and/or .CRT .displays . The current .estimate is that 40 analog parameters 
will be processed by the routine. Each parameter will have four sets 
of high/low limits as an average. One set of these limits will be 
active during the various flight pases or modes. 

The GN&C MDE computer control program will perform all 
input checks at either a 25/second or 2/second rate. The input data 
sources are the input buffers. 

Upon completion of the input via the executive program, 
the control program will dispatch the Performance Monitoring tasks. 

After routine initialization, active interrogation of the current para- 
meter value to the active limits is initiated. If no parameter is founc 
out of tolerance^ all parameters will quickly be processed and control 
passed back to the control program. 

- If a parameter is found out of, tolerance, a test is made 

to determine if the parameter has been out of tolerance "n" times. The j 

* i 

currently assumed value of "n" is two.' This test prevents noise from 
causing superfluous no-go indications. If "n” successive conditions ! 
have been encountered, the type of crew notification required is 
interrogated. If an mnunciator activation is specified, an 8-bit 
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annunciator address code is placed on the control program output data 
list for transmission to the annunciator panel at the end of the 
processing cycle. 

Measurements that are out of tolerance can be designated 
as a disregard for error notification by the crew. This capability 
is useful for stopping continuous error displays caused by invalid 
measurement readings. The disregard designation is made by requesting 
display of the format containing the measurement in error and utilizing 
the line designator switch on the MDE to identify the measurement. A 
cancel disregard designation is made in a similar manner. 

If a CRT display is specified several actions occur. 

First, an indicator is set in the format skeleton associated with the 
out of tolerance parameter. When this format (page) is displayed, the 
appropriate parameter will have appended the out of tolerance flag 
which allows the crew to quickly see those out of tolerance conditions 
associated with the subsystem. For analog measurements, the flag will 
indicate the direction, high or low. of the out of tolerance condition. 

The routine will then request a flag message display 
which will appear on the scratch pad (line 14) of the display the next 
time the Display Support routine updates the current display. The message 

i 

will notify the crew that Performance Monitoring has detected an out of | 

• j 

tolerance condition and will specify the page number on which the 

condition can be viewed. If the scratch pad is currently being used 
by the crew to enter a command, the display will be delayed until the 
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area is free. A related annunciator will notify the crew of the 
condition. The scratch pad line may then be cleared via the keyboard 
to free it for the error message. 

In addition, a one line message is added to a queque of 
messages that reflect a summary of all out of tolerance conditions 
existing at the current time. These one line messages are displayed 
when the crew requests the Performance Monitor Status page and will re- 
flect the 12 most recent out of tolerance conditions. Earlier mal- 
functions may be viewed by "paging” through the Performance Monitor 
Status displays via a special keyboard command. Provision will be made 
to accommodate up to 64 of the one line malfunction messages (4 x 16) . 

If both panel and CRT crew notification action is 
specified for a particular parameter, both of the above described panel 
and CRT sequeces occur. - 

When a parameter that has previously been out of tolerance 
comes within tolerance, the converse of the above steps is performed. 

The annunciator is^ reset and/or the one line message in the Performance 
Monitoring Status format is purged and the remaining entries compressed. 
The crew notification scratch pad line message is removed if applicable. 

The above discussion described the comparison of the 

’ i 

current parameter value to the active limits. The active limits are j 

- - • . . . - | 

established by a separate module identified as the Performance Monitor j 

Phase Initializer. This module , is called by the control program upon 
flight phase changes, or as commanded by the crew. Additionally, 
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measurement limit changes required for vehicle status change (e.g., 
engine firing) will be effected by monitoring discrete signals for the 
change in status. The Performance Monitor Phase initializer will have 
tables that associate the phase to the appropriate limits to use for each 
of the parameters for that phase. The tables have been sized to accommo- 
date an average of four sets of high/low limits. 

2.. Discrete Processing - The Performance Monitor module 
will be provided to verify the correct status of certain subsystem in- 
put discretes Similar to the analog processing module, if a discrete 
is found to be in an incorrect state, the crew will be notified via panels 
and/or CRT displays. 

The current assumption is that 60 GN&C discrete parameters 
will be monitored at a 25/seconS or 2/second rate. 

The Executive control program will perform all input opera- 
tion and pass control to the discrete processing module. After module 
initialization, groups of 16 discretes will be tested to determine if 
any one of the 16 discretes has changed. If none have changed, other 
groups are tested until the scan is complete. 

If a discrete has changed a table entry is interrogated to 
determine the type notification specified. Again, this can be via 

i 

annunciators, CRT, or both. If annunciator notification is specified, 
an eight bit annunciator address code and an associated on/off bit are 
quequed for output. 

i ! 






-398 


date 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-345 

REV-. 

BINGHAMTON. NEW YORK 

REP. NO. 


If CRT notification was specified, an "allow/disallow" table 
is interrogated to determine if the change was allowable. If so, no 
additional action is taken and the scan of other discretes continues. 
Presumably, the discrete for the current phase is not considered a part 
of the performance monitoring. If the discrete change is not allowed 
and is currently in the incorrect state, the same sequence as was done 
in analog processing is performed. The "out of tolerance" indicator is 
set in the format skeleton on which the discrete appears, a notification 
is placed on the scratch pad line, and a one line summary message is 
inserted in the Performance Monitoring Status format buffer. The use 
of this presentation is the same as described in the analog description. 
If the discrete change is to the correct state the converse of the above 
sequence is performed . 

The initial discrete status and the control routines access 
to the proper "allow/disallow" and "should be" tables is established 
by the Performance Monitor Phase Initializer. This is the same routine 
mentioned earlier in the analog processing section. A set of allow/ 
disallow and should-be tables are provided for each flight phase. 





DATE 10/20/72 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 


PAGE NO. 


4-346 


REV. 


BINGHAMTON. NEW YORK 


REP. 


NO. 


4.19 .4.3 Performance Monitor (PM’) System 

The PM system consists of two MDE processors dedicated to 
the monitor and display of non-GN&C systems status or to the solution 
and display of the backup guidance and navigation function. One of the 
PM MDE processors capabilities is obtained by time sharing the center 
console GN&C MDE, between the GN&C display functions, the PM function, 
and the backup G&N functions. The PM MDE's will contain backup G&N 
programs so that a "get me home" capability is available in the event 
of a generic software error or other critical system failures. Reload 
of the MDE memory for a change of functions will be provided by a tape 

read-only memory under control of the crew. 

Performance monitoring includes two primary functions: (1) 
Continuous limit/status checking of 300 analog and 300 discrete non- 
GN&C subsystem measurements with fault annunciation and PCM recorder 
control in the event of a malfunction: (2) Generate page format CRT 
display of related subsystem measurement sets at the flight crew's 
discretion. 


The limit/status check program is executed at a two/second 

rate and contains false alarm avoidance provisions. No-go's are dis- 

■ / 

played on an annunciator light matrix that identifies the problem area 

i 

and on a CRT "scratch pad" line that identifies the particular page on 
which the no-go parameter value can be observed. Growth provisions in- 
clude consumables management, ground checkout usage, and redundant para- 
meter tracking. Emphasis is placed on keeping the processing simple 
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during the high vehicle subsystem change activity that will be encountered 
during the development phase. 

Performance Monitoring Software 

1. Analog Processing - A performance monitor module shall be 
provided to verify that all non-GK&C subsystem analog parameters are 
within a predefined set of high/low limits. An out-of-tolerance condi- 
tion will cause notification to be made to the crew via subsystem 
annunciators , CRT display, or both annunciator and CRT. The current 
assumption is that 300 analog parameters will be processed by this 
routine. Each parameter will have three sets of high/low limits, on the 
average. One set of those limits will be active at a time. 

The control program will input an entire set of the 
selected PCM measurements at a fixed predetermined rate, as described 
earlier. The input data source is the OFI Master Controller. Upon 
completion of the input routine, the control program will dispatch the 
performance monitor tasks. 

After routine initialization, the analog measurements 
will be converted to engineering units, and in that form will be tested 
with respect to the active limits. Refer to the general program flow 

1 s 

shown in Figure 4.19.4-3. If no parameter is found out of tolerance, j 

• i 

all parameters will quickly be processed and control passed back to 


the control program. If a parameter is found out of tolerance a test is! 
made to determine if it has been out of tolerance "n" consecutive times. 
This test prevents noise from causing superfluous no-go indications. 
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If the error count has not yet reached "n" for that parameter, it's erro 
counter is incremented and processing of other parameters continues. 

If the error count had reached "n", the type of crew notification re- 
quired is interrogated. If an annunciator activation is specified, an 
8-bit annunciator address code is placed on the control program output 
data list for transmission to the annunciator panel, at the end of the 
major processing cycle. 

Measurements that are out of tolerance can be designated 
as "disregard for error notification" by crew. This capability is usefu 
for stopping continuous error displays caused by invalid measurement 
readings. The disregard designation is made by requesting display of 
the format containing the erroneous measurement, and utilizing the 
line designator switch on the MDE assembly to identify the measurement. 

A "cancel disregard" designation is made in the same manner. 

If a CRT display is specified several actions occur. 
First, an indicator is set to identify the no-go condition as "high" or 
"low". The routine then sets up a message for line 17 of the current 
display, which specifies the format number associated with the faulty 
parameter. The message notifies the crew that an out of tolerance 

1 

condition has been detected and will specify the page number on which j 

i f ., 1 

the condition can be viewed. If the scratch pad (line 17) is currently j 

■■■■ . ! 

in use, the display will be delayed until the area is free and a dis- 
crete notification of the conflict will be issued to the MDE . Next, 
a one-line message is added to a queue of messages at the current time. 
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These one-line messages are displayed when the crew requests the 
Performance Monitor Status page, and will reflect the 16 most recent 

ts . i 

out of tolerance conditions. Earlier malfunctions may be viewed by 
"paging" through the four-page Performance Monitor Status displays via 
a special keyboard command. Provision will be made to accommodate up to 
64 of the one-line malfunction messages (4 pages x 16 measurements per 
page) . If both panel and CRT crew notification action is specified for 
a particular parameter, both of the above described panel and CRT 
sequences occur. 

When a parameter that has previously been out of tolerance 
comes within tolerance, the converse of the above steps is performed. 

The annunciator is reset and/or the one line message in the Performance 
Monitoring Status format is purged and the remaining entries compressed. 
The crew notification scratch pad line message is removed is appropriate. 

The above discussion described the comparison of the 
current parameter value to the active limits. The active limits are 
established by a separate module identified as the Performance Monitor 
Phase Initializer. This module is called by the control program upon 
flight phase changes or as commanded by the crew. Additionally, measure- 
ment limit changes required for vehicle status change (e.g., engine 

i 

firing) will be effected by monitoring discrete signals for the change j 

in status. The Performance Monitor Phase Initializer will have tables i 

that associate the phase to the appropriate limits to use for each of 

the parameters for that phase. The tables have been sized to accommo~ 
date an average of three sets of high/low limits. 
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2. Discrete Processing - A Performance Monitor module 
shall be provided to verify the correct status of certain subsystem 
input discretes. Similar to the analog processing module, if a discrete 
is found to be in an incorrect state, the crew will be notified via 
panels, CRT or both panel and CRT. 

The current assumption is that 300 discrete parameters will 
be monitored at twice per second rate. The Discrete Performance Monitor 
module is briefly described. Refer to Figure 4JL9».4-4 for the general 
program flow. 

The control program will perform all input and pass control 
to the discrete processing module. After module initialization, groups 
of 16 discretes will be tested to determine if any one of the 16 
discretes has changed. If none have changed, other groups are tested 
until the scan is complete. 

If a discrete has changed, a table entry is interrogated to 
determine the type notification specified. Again, this can be via 
annunciators, CRT, or both. If annunciator notification is specified, 
an eight bit annunciator address code and an associated on/of f bit are 

! " * i ' 

queued for output. * .- - - r - i — r - • 

..... S 

If CRT notification was specified, an "allow/disallow" table j 

; I 

is interrogated to determine if the change was allowable. If so, no j 
additional action is taken and the scan of other discretes continues. 
Presumably, the discrete for the current phase is not considered a part 
of the performance monitoring. If the discrete change is not allowed 
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and is currently in the incorrect state, the same sequence as was done 
in analog processing is performed. The "out of tolerance" indicator is 
set in the format skeleton on which the discrete appears, a notification 
is placed on the scratch pad line, and a one line summary message is in- 
serted in the Performance Monitoring Status format buffer. The use of 
this presentation is Jthe same as .described in the analog description. 

If the discrete change is to the correct state, the converse of the 
above sequence is performed . 

The initial discrete status and the control routines 
access to the proper "allow/disallow" and "should be" tables is estab- 
lished by the Performance Monitor Phase Initializer. This is the 
same routine mentioned earlier in the analog processing section. A 
set of allow/disallow and should-be tables are provided for each flight 
phase . 

Display Software - The display software performs the func- 
tion of organizing and presenting engineering unit subsystem data for 
CRT display. Thg^following paragraphs describe the display software 
subprograms, which are stored in the processor, and the display formats, 
skeletons of which are resident in the MDE memory. . .i_ - 

1. For Description - Subsystem status information is j 

' • * ‘ I 

presented on the CRT in predefined logical groups . A single group or ( 
format is presented at a time. Each format consists of a title line, ! 
1 to 16 measurement lines, and a scratch pad line. Each line may 
contain up to 24 characters. The measurement lines each contain 
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three fields; for sizing purposes a 12-character measurement description!, 
a 5-character measurement value, and a 4-character engineering unit label 
are assumed. The scratch pad line is used for the display of keyboard 
input data and messages from performance monitoring software. The 
format skeletons (exclusive of the actual parameter values) are stored 
in the MDE memory, and contain the alphabetic measurement name, engineer- 
ing units (for example, "PSIA") , decimal points, display edit information, 
and Format Control Words (FCW's). The FCW's specify character genera- 
tion control information, x and y CRT position data, and mode control 

data . . 

An "interface dictionary" (table of data), which is 
resident in the display processor, is associated with each format. It 
contains data which describes and controls the processing unique to 
each measurement on a given format. The dictionary contains the 
measurement number, conversion scale factors and biases, output codes, 
test limits, and certain flags and pointers. 

The maximum MDE storage requirement for a 16-measurement 

format is: 

17 lines of 24 characters + carriage return - 215 words 
x, y position and control words 4 words 

: ' . j i 

i 

; Format Control and edit inf ormation ; \ — 18 words ( 

Total 16-bit words for one format : 237 words \ 

'■ . ; . i. " 
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The display processor storage requirement for the inter- 
face dictionary data associated with a 16 (analog) measurement format 
is: 

Measurement designators, 16 x 12 characters 96 words 
Scale factors (1 # byte,+ Bias (2 bytes) 24 words 

Output codes (9 CRT, 3 annunciator) 2 words 

Test Limits, 3 sets at 1 word/set 48 words 

Total 16-bit words for one format: 170 words 

Total interface dictionary size for 
35 formats: 5950 words 

2. MDE Keyboard Processing - The MDE keyboard and line- 
select pushbuttons are used by the crew to select formats for display, 
and to specify flight measurements which are to be excluded from per- 
formance monitor error notification. Activation of the data entry- 
format select keys result in its display on line 18 of the CRT. The 
line-select keys are also stored, but not displayed. Activation of a 
specific key wilj. result in a signal of the display processor, which 
responds by reading the input buffer data and routing it to the proper 

processing program. Figure 4.i 19.4-5 describes the display processing 

! ..... ... 

flow. 

: 3. Display Update Processing - Display update processing j 


consists of determining which format has been selected for display, 
assembling, and organizing the appropriate parameter values and status 
flags, and scheduling data for output to the CRT and/or annunciator. 
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When the display format has been identified, the interface dictionary 
is searched to determine which of the parameters are to be displayed. 

The engineering unit values (previously stored by the performance monitor 
routines) are queued for output to the CRT by the output program. The 
status (go or no-go) of each parameter is inspected and if appropriate, 
a one line .me.s.s.age is queued for transmittal and display on one of the 
four performance mointor status pages. 
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4.19.4.4 Payload (PLV System 

The PL system consists of two MDE processors dedicated to 
the status, control, checkout, initialization, and display of payload 
data. The PL computers which contain identical programs will both be 
active but only one will be in control. The PL system will not be re- 
quired to process onboard experiment data which will be either recorded 
onboard or transmitted to the ground for processing. Data transmission 
and recording will not require the PL computer participation. Memory 
growth capability for the PL computer system is provided by a dedicated 
read-only tape memory unit. 
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4.19.5 Rationale 


Not 

applicable . 



4.19.6 Assumptions 


"Index"and "Page Select" keys are on keyboard. 

4.19.7 Data References 

187 AP101/SP1 IBM OBC Candidates for Shuttle 

232 MSC-03329 Space Shuttle Alternate Avionics System 

Study and Phase B Extension Final Report 
12 November 1971 

. Pages 2.10-1 thru 2.10-48 

2.5-16 thru 2.5-24 

166 SD72-SH-50-3 Technical Proposal for Space Shuttle 

Program Volume III 12 May 1972 
Pages 3-95 thru 3-122 


41 SD72-SH-0023 Space Shuttle Phase B Avionics Final 

Report 8 March 1972 - • 

Pages 96 thru 103 
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4.20 MAIN ENGINE CONTROLLER 

REF. When the Space Shuttle vehicle operation requires the 

42 

engine to start, operate at a given power level, or shut 
down, the vehicle sends a command to the engine. The con- 
troller is the electronic unit that receives these commands, 
determines the appropriate actions, and issues instructions 
to the engine controls. If the engine does not respond in 
a normal manner to these instructions, the controller modifies 
the instructions appropriately. If the engine parameters 
exceed predetermined limits and the limit control is enabled 
by the vehicle the engine is shut down by the controller. 

Responsive control of the engine thrust level and 
mixture ratio is achieved by the controller updating the 
instructions to the engine controls fifty times a second 
(every 20 msec) . The = controller has the capability of 
interrupting the normal cycle for an update in less than 
20 msec when the vehicle transmits a new command to the 
engine or acomponent failure warrants the interruption. 

Precise engine performance is achieved through closed- 
loop control, a 16-bit computer word, 12 bit input-output 
resolution and self calibrating analog to digital conversion. 
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4.20.1 CONTROLLER DESIGN REQUIREMENTS 

The controller is required to perform the following 

REF. 

42 ’ functions to implement the Avionics control, checkout and 
monitoring requirements. 

1. Interface with the vehicle to receive engine 
commands and transmit data. 

2. Interface with and provide signal conditioning, 
multiplexing and analog-to-digital conversion for 77 sensor 
signals and 93 analog built-in test signals. Also, provide 
pulse rate to digital conversion for 16 pulse sensor signals 
and 6 spark rate built-in-test signals. 

3. Interface with and provide output electronics to 
command 5 proportional actuators (10 hydraulic servovalve 
torque motor coils and 22 solenoid coils), 13 pneumatic 

solenoid coils, and 6 spark igniters. 

w. 

4. Process vehicle commands and engine performance 
data to provide closed-loop control at a rate of 50 times/ 
second (every 20 msec) for start, shutdown and mainstage 

, t 

control. 

5. Provide built-in test hardware and software pro- 
grams to validate the Avionics and engine system by conduct- 
ing automatic self tests every 20 msec. |>erforming engine 
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REF. checkout on vehicle command, and performing engine limit 
42 

monitoring. 


6. Control engine purges upon vehicle command, 
monitor engines readiness to start and provide an engine- 
ready signal to the vehicle. 

7. Provide engine maintenance data to the vehicle 
data recording system. 

8. Provide redundancy to meet electronic fail-operat- 
ional/fail-safe design requirements. 

9. Provide electrical interfacing with redundant 
vehicle power buses and provide power switching, conversion, 
and distribution for the engine. 

10. Provide connectors and circuitry for ground 
support equipment to alter and verify memory. 

11. The controller is designed to operate without the 
use of external cold plates or cooling media. 

• i 

The controller design requirements listed in Table 
4.20-1 are principal requirements imposed by Rocketdyne for 
the controller design, including those imposed by the engine 
CEI and ICD requirements. 
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REF. TABLE 4. 20 d 1 SWIMARY OF 

SSME CONTROLLER REQUIREMENTS 

42 





■ 

DESCRIPTION 

REi'JI RE-EnT 

DESCRIPTION 



2 

EKYIROn-ENT 





TRANSPORTATION AND 



C’lFATIHS PJAATlCN 

0-500 SCCCIOS, MPL TO NPL 

STORAGE 




0-453 SECONDS, EPl 

TEMPERATURE 

-65 TO »I65 F 



UIILIHITEO, CHECKOUT AREA 

HUMID 1 TY 

100 PERCENT 




ACCELERATION 

OPERATION 

4.0 G 


ELECTRICAL 


temperature 

-170 TO *130 G 





HUMIDITY 

100 PERCENT 


POWER 

DUAL 115/200 VAC. 3 PHASE 

PRESSURE 

IS PSIA TO VACUUM 



405 HZ, iJZ V PCAK, 550 

VIBRATION 

70 G PEAK SINE, 535-3000 H2 . 



V STEADY STATE MAXIMUM AT 


31 G RMS P ANCON, COMPOSITE 



NOMINAL VOLTAGE 

. ' 

(1 SICMA LEVEL) 


INTERFACES 

VEHICLE - PER ICO RSS-35DO-S 

ACOUSTIC 

174 c"b 



CSE - AS P.EC.UIRcD TO ALTER 

•ACCELERATION 

i3.5 G 



memory and operate controller 

ADDITIONAL REQUIRE- 




FP.CM r.ROUMO 

KENTS 

SALT SPRAT 



SENSORS - 23 PRESSURE, IJ 


SAND AND OUST 



TEMPERATURE , 6 FLOW, 8 
SPEED, 7 VI ORATION AND 23 





POSITION 

WEIGHT 

81 LBS 



OUTPUT - 10 SERVO VALVE COILS, 

* 




35 SOLENDI D-CO 1 LS AND 6 SPARK 
IGNITERS 

SAFETY FACTORS 

YIELD, 1.) LIMIT DESIGN 


_ 

.. 

• . 

LOAD 





ULTIMATE, 1.4 LIKIT DESIGN 


DATA PROCESS INC 
SA“?LE RATE 



LOAD 

PROOF, 1.2 LIMIT DESIGN 


20 MS MAJOR C V CI.E TIME 


LOAD 


DATA RATE 

10,000 SITS/SEC - ENGINE TO 


BURST, 1.5 LIMIT CESICN 



VEHICLE 

100,000 6ITS/SEC -OEVELOP- 


LOAD 



MENT TESTING 






FATIGUE FACTORS 

4 (THERMAL CYCLES) 


DATA TRANSFER RATE 

1 .000,003 BITS/SEC 


10 (MECHANICAL CYCLES) 


. . htJO.^Y STORAGE 

12, ODD WORDS, FULLT REPRO- 

- 




CRA.mmA.5LE WITH MEMORY 
LOCKOUT 

PARTS 

PER 85M03526 


FAIL SAFE CESII.C 

FAIL OPERATIONAL - FIRST 

CORROSION RESISTANCE 

PROTECT FINISHES PER M$FC- 



FAILURE 


SPEC-250 



FAIL SAFE - SECOND FAILURE 

• 


PER HSFC - D«-40m.39S63 


SERVICE LIFE 

100 ENGINE STARTS TO NPL 


PER MIL-STD-461, 452 

1 


6 ENGINE. STARTS 70 EPL 
CHECKOUT - UNLIMITED 


PER HIL-B-5037, CLASS R 

i 




PER MIL-ST0-130 

! 

KA IMTAIN ABILITY 

NO SCHEDULED SERVICING BETWEEN 




RECYCLES-ACCESSA5LE FOR 

INTERCHANGEABILITY 

PHYSICAL AND FUNCTIONAL, 



REPLACEMENT 

BUILT-IN-TEST ISOLATES FAULTS 


COMPLETE, ‘i 
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REF. 4.20.2 CONTROLLER DESIGN DESCRIPTION 
42 

The controller is a single integral electronics package 
mounted directly on each of the three main engines. The 
controller electronics are housed in a pressurized aluminum 
case assembly specifically designed to provide thermal and 
vibration protection during ground and flight operation. 

The total package weight is 81 pounds (36.7 kilograms). 

The functional relationship of the controller to the 
engine is illustrated in Figure 4.20-1. Engine performance 
data are received from engine sensors. Vehicle commands 
and requests for data are received from the vehicle /engine 
interface. Control decisions made by the digital computer 
on the basis of these inputs are issued to three types of 
engine controls, i.e., actuators, on*off valves, and 
igniters. Information on operation of the actuators is fed 
back to^the controller. The controller transmits engine 
data to the vehicle through the vehicle /engine data bus 
Interface. - 

- . The electronics within the controller are divided 

into five subsystems: 

1. Input Electronics - Receives data from all in- 
flight sensors, converts it to digital form and sends it 


PAGE N ff*-365 

REP. NO. 


DATE 10/20/72 

REV. 






- 398-8 - 


DATE 10/20/72 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 


PAGE NO. 4-365 


REV. 


BINGHAMTON. NEW YORK 


REP. 



Figure 4.20-1 


Engine Controller Functional 
Relationship 




NO. 
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REF. to the computer interface electronics. Since the accuracy 
42 

of these electronic circuits contributes directly to con- 
troller accuracy, they are continuously monitored and re- 
calibrated by the computer. 

*2. "Computer Interface "Electronics - Controls the flow 
of all data within the controller. 

3. Computer - Receives sensor data, vehicle commands, 
and vehicle data requests. It performs computations, issues 
engine control commands, and stores engine data until 
requested by vehicle. The computer also conducts tests of 
all control system components once very 20 msec. The 
computer includes a 12,288-word memory which stores the 
control and test programs and the engine performance data. 

4. Output Electronics - Converts the computer digital 
control commands to voltages suitable for powering the 
engine igniters, on-off controls, and actuators. 

5. Power Supply Electronics - Converts the vehicle 
electrical power to the individual power supply voltages 
required by the Avionics system. 

Detailed functional schematic diagrams of the elec- 
tronics are contained in Avionics (550K) Drawings Report, 
Volume 76. 
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REF. The controller design is straightforward for minimum 

2 

risk in development and operation. Low risk is achieved 
through the use of proven technology, built-in flexibility, 
and conservative design. 

The most significant single factor in reducing develop- 
ment risk is the adaptation of the Honeywell HDC-601 air- 
borne computer to the SSMB application. The HDC-601 is 
completely developed, production released. 

Much of the substance of the HDC-601 (Table 4.20-2) 
is directly .transferable to the controller application. 

The remainder is straightforward adaptation with minimal 
development risk. The HDC-601 has the required speed and 
accuracy, and is designed specifically for real-time control. 
The HDC**601 and its commercial counterparts, the DDP-516 
and H-316 are presently fulfilling the requirements of 
numerous real time control applications. The H-316 uses 
the same logic as the HDC-601 but is packaged for commer- 
cial applications. The computer uses' a plated-wire .memory. 
The process of reading data from the memory does not dis- 
turb the contents of the memory; therefore, no additional 
time is required to restore the data in the memory as is 
the case with core types. Plated wire memories are more 
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SABLE 4.20-2 APPLICABILITY OF HONEYWELL HDC-601 

TO SSME CONTROLLER 


CHARACTERISTICS 


KX-SDI CCNPUTES 


SSM£ CONTROLLER 


VDRO LENGTH 
R£AL-T|mE CONTROL 
MEMORY ACCESS 
STANOA.RO software 


OPEP.AT | CNAL SOFTWARE 


INTEGRATED CIRCUITS 
AND QUALIFICATION 

CIRCUIT PACKAGING 


CHASSIS WIRING 


COMPONENT COOLING 


FULLY DEVELOPED 


VIA PRIORITY INTERRUPTS 

DIRECT AND UNDER PROGRAM CONTROL 

FULLY DEVELOPED ANO FIELD TESTEdT 
co-patisle with ddp-s 16 C0““ 

CIAL COMPUTER 

0EVEIC°E0 SPECIAL FOR EACH 
APPLICATION 


5 HIL PLATED WIRE 


S«ALL AND HEDIUh SCALE 8 1 POLAR 
TTL TO HU.-STC-233, LEVEL A 

EDGE SUPPORTED PRINTED WIRING 
.'ARDS WITH PLUG- IN CONNECTORS 

WIRE-WRAPPEO POINT-TO-POINT 

FORCED AIR CONVECTION 


SAME AS HDC-601 
SAKE AS HDC-601. 
SAKE AS HDC-601 
SAKE -AS HDC-601 
SANE AS HDC-601 


KAY SE VERIFIEO ON COMMERCIAL DDP-SI6 PRIOR TO 
“C0llTP.CLLER~AVATLA8iLITY 

SAKE AS HDC-601 WITH 2 KIL PLATED WIRE FOR 
LOWER' POWER AND CREATER SPEED 

SAKE AS HDC-601 PLUS NASA X-RAY ANO SERALIZATIOM 


-USES SAKE CIRCUIT LAYOUT, EUT WITH "FOAMPACK" ~ 
MOUNTING TO MEET SSkE ENVIRONMENTAL REQUIREMENTS 

SAKE AS HDC-601 — 

'DIRECT CONDUCTION TO CHASSIS VIA ”FOAK PACK" 
THERMAL INSERTS 
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REF. environmentally resistant than core types and operate over 
42 

wider temperature ranges for any given speed. Vibration 
resistance is superior since the plated wires are embedded 
in epoxy planes sandwiched with the electronics boards into 
a compact rigid package. The controller memory uses 2-mil 
wire which requires one-fifteenth the power of core memories. 
The 2-mil memory is operated with low-power electronics, 
minimizing the number of components and improving the 
reliability. 

The majority of the input-output electronics circuits 
have been developed and proven on prior Honeywell systems. 

Flexibility inherent in the controller design also 
reduces development risk by accommodating the changes and 
unforeseen contingencies , that arise in a normal development 
program. 

Twenty percent spare connector pins and input/output 
electronics are included to provide for additional growth 
in the quantities of sensors, actuators or solenoid valves. 
The spare electronics will be wired into the controllers 
for development engines and those needed for the final 
design can be included in production controllers by adding 
duplicates of existing wiring board assemblies. Similarly, 
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REF. added control functions can be accommodated since 30 percent 
42 

of the computational duty cycle is unused and 41 percent of 
the memory is uncommitted. 


A major contributor to the flexibility of the controller 
-design is ^the ^uss -of <dig*i'tal Father than analog computation. 
Changes in operational sequences and functions may be accom- 
plished simply by changes in computer software programs, 
avoiding costly and time-consuming hardware redesign, retrofit, 
and reverification. The flexibility of software programming 
also accelerates the schedule by permitting hardware design 
and build to proceed while software development is conducted 
in paralle. The use of wire-wrap interconnections greatly 
simplifies wiring alterations. 


4.20.3 CONTROLLER INTERFACES . 

The main engine controller interfaces are listed in 
Table 4.20-3. 
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TABLE 4.20-3 CONTROLLER 

interfaces 



REF. 224 

- 


. . . .-si 



• 




Baseline 






Humber of 

Snare 

Total 




Interface 

Interface 

» Humber of 




Circuits 

Circuits 

Interf aco 

Intcrf 

ace 


P.eouired 

Peoui red 

Circuits 

V. chicle .Power 

Bus 



3 

0 

3 

^ehicle/Enainc Electrical Interface 




a . Command 

Channels 



3 

0 

' '3 

b. recorder Channels 



2 

0 

2 

1 Pressure Sens 

ors 






a. External 



28 

G 

34 

b. Internal 



2 

0 

2 

: Temnerature S 

ensor 





- 

a. Hot Cas 

(50 ohms) 



4 

2 

r. 

b. LII2/LOX 

(5E ohms) 



: . * 6 

1 

7 

c. LH2/LOX 

(1 . 38K ohms) 



i 

5 

G 

d. Controller Internal 



3 

0 

3 

' * 

Leal: Detection Sensors (Fnace 

Provision Onlv) 



riov; Sensors 




o 

L> 

2 

10 

Sneed Sensors 




8 

0 

o 

u 

Position Sens 

ors 






a. Actuato 

r* 



10 

2 

12 

b. Servovalve/Bleed Valve 



10 

2 

12 

Vibration Sensors 






a. Padial 




4 

1 

5 

b. Longitudinal ' 



3 

1 

4 

fnark loniter 







a. Command 

'2=8-, 



6 

0 

G 

b. Eonitor 




G 

0 

G 

j On/Off Solenoid Coils 






a. Pneumatic 



7 

2 

9 

b. Hydraulic 

1 



20 

5 

25 

j Sex vo Valve 




8 

2 

10 

GSE Interface 










A 
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4.20.3.1 VEHICLE/ENGINE ELECTRICAL INTERFACE 

The vehicle to each engine controller interface will 


consist of eight individually twisted shielded pairs of wire. 
These wires will be divided into three command channels of 
two shielded pairs each and two recording channels of one 
shielded pair each. Each command channel will consist of 
one pair for transmission of commands to the controller and 
one pair for transmission of data and command echoes to the 
vehicle. Each recorder channel will consist of one pair 
for transmission of recorder data to ; the vehicle. For 
redundancy, .the controller will have three connectors, one 
connector for each command channel with a recording channel 
in two of the connectors as defined in the ICD. 


vehicle to Controller Signal Characteristics 


Transmission Rate 


10^ bits per second 


Code ; 


Manchester Bi-Phase (Level) 
Square Wave 


Coupling : 


Transformer Isolation 


Characteristic Impedance : 150 ohms +'10 percent 


Input Impedance; 


Characteristic impedance 


Input Voltage Impedance : Greater than 5 volts p-p 


Signal Rise time : 


Less than 250 Nano-seconds 


Signal Fall time; 


Less than 250 Nano**seconds 
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Vehicle to Controller Signal Characteristics (cont'd.) 

Signal Overshoot: Less than 20 percent 

Signal Undershoot Less than 20 percent 

Skew: Less than 32 microseconds between 

any two channels 


Controller to Vehicle Signal Characteristics 


Transmission Rate; 
Code ; 

Coupling: 


10° bits per second 

Manchester Bi-Phase (Level) 
Square Wave 

Transformer Isolation 


Characteristic Impedance: 150 ohms + 10 percent 


Driving Capability: 


Minimum of 250 feet 


Output Voltage Amplitude: Greater than 5 volts p-p at 

receiving end 


Signal Rise time : 
Signal Fall time: 
Signal Overshoot: 
Signal Undershoot: 
Signal Droop: 

Skew: 


Less than 250 nano-seconds 

Less than 250 nano-seconds 

Less than 20 percent 

Less than 20 percent 

Less than. 20 percent 

Less than 32 microseconds between 
any two channels 
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REF. Channel Clock . The clock for each command channel 

224 

will be derived from the respective command channel infor- 
mation. The clock for each engine status data and command 
echoes channel to the vehicle will be derived from the con- 
troller internal clock. The clock for each recorder channel 
will be derived from the controller internal clock. 

Word Sync . The word sync pulse, for both command and 
recorder channels, will be designated by two consecutive 
360 degree pulses. Each pulse will be one-bit time in 
duration. The polarity of the first pulse will be equal to 
the first 180 degrees of a logical "l" state. The polarity 
of the second pulse will be inverted from the polarity of 
the first pulse. 

Command Word . Command words from the vehicle .will 
consist of 15 bits plus a parity bit per word. The relation- 
ship between the word sync pulse, command information, and 
parity bit is shown in Figure 4.20-2. Valid commands are 
listed in Table 4.20-4. Command code" format is shown in 
Table 4.20-5. 

Commands from the vehicle will consist of two basic 
types of commands. These are defined as absolute commands 
(i.e., start, shutdown, automatic checkout, etc.) and vari- 
able commands (i.e., thrust and mixture ratio). 
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REF. 224 



NOTE; MANCHESTER BI-PHASE LEVa 
'ONE" IS REPRESENTED BY A 10 
"ZERO IS REPRESENTED BY A 01 


Figure 4.20-2 Command /Status, Echo and Recorder Word 
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REF. 225 TABLE 4.20-5 VEHICLE /ENGINE COMMAND CODE FORMAT 



BINARY CODE OCTAL CODE COMMAND 


: O'-O 

ooo 

010 

001 

111 

217 

AUTOMATIC CHECKOUT 

000 

ooo 

010 

ooo 

001 

201 

PURGE SEQUENCE NO . 1 

i 000 

ooo 

010 

ooo 

010 

• 202 

PURGE SEQUENCE NO. 2 

' 000 

ooo 

010 

ooo 

Oil 

203 

PURGE SEQUENCE NO. 3 

' 000 

ooo 

010 

ooo 

100 

204 

PURGE SEQUENCE NO. 4 

0.00 

ooo 

010 

001 

ooo 

210 

START 

1 000 

ooo 

010 

ooo 

101 

205 

SHUTDOWN 

! ooo 

ooo 

001 

ooo 

ooo 

100 

THRUST LEVEL ^ 

j 


to 



to 


j 000 

ooo 

001 

111 

oil 

. 173 

* 

000 

ooo 

ooo 

ooo 

001 

001 

MIXTURE RATIO ^ 



to 



to 


coo 

coo 

ooo 

010 

110 

026 . 


A ' ooo 

ooo 

Oil 

ooo 

010 

302 

COMMAND EXECUTE 

^ ooo 

ooo 

010 ooo 

110 

206 

LIMIT CONTROL INHIBIT 

ooo 

ooo 

010 

ooo 

111 

207 

° LIMIT CONTROL EXA3LE 

ooo 

ooo 

010 

001 

001 

211 

ABORT TURNAROUND PURGE SEQUENCE NO. 

ooo 

ooo 

010 

001 

010 

•212 

ABORT TURNAROUND PURGE SEQUENCE NO. 

. ooo 

ooo 

010 

001 

Oil 

213 

OXIDIZER DUMP 

ooo 

ooo 

010 

001 

100 

214 

FUEL DUMP 

ooo 

ooo 

010 

001 

101 

215 

TERMINATE PROPELLANT DUMP 

ooo 

ooo 

010 

010 

ooo 

220 

MAIN FUEL VALVE 

j ooo 

ooo 

010 

010 

001 

• 221 

MAIN OXIDIZER VALVE 

j ooo 

ooo 

010 

010 

010 

222 

FUEL PRF. BURNER OXIDIZER VALVE 

j 000 

ooo 

010 

010 

Oil 

223 

OXIDIZER PREBURNER OXIDIZER VALVE 

! ooo 

ooo 

010 

010 

100 

224 

COOLANT CONTROL VALVE 

J ooo 

1 

ooo 

010 

001 

110 

216 

. CONTROLLER RESET 

. ooo 

ooo 

010 

Oil 

100 

234 

FUEL FLOWMETER SPIN TEST 

ooo 

ooo 

1110 

Oil 

101 

235 

OXIDIZER FLOWMETER SPIN TEST 

! ooo 

ooo 

010 

Oil 

110 

236 

SEQUENCE CHECK 

A: 000 

ooo 

010 

010 

101 

225 

ON 2 SYSTEM PURGE CONTROL VALVE 

OOO 

ooo 

010 

010 

110 

226 

FUEL SYSTEM PURGE CONTROL VALVE 


co 
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TABLE 4.20-5 


VEHICLE /ENGINE COMMAND CODE FORMAT 
(cont'd.) 


BINARY CODE 


OCTAL CODE 


000 

000 

010 

010 

111 


227 

000 

000 010 

oil 

000 


230 

000 

000 

010 

on 

001 


231 

000 

000 

"oro 

-oil 

0T0 


232 

000 

000 

010 

Oil 

Oil 


233 

000 

000 

Oil 

000 

100 


304 

000 

000 

010 

111 

001 


271 

000 

000 

010 

111 

010 


272 

000 

000 

010 

111 

100 


274 

000 

000 

010 

110 

001 


261 

000 

000 

010 

110 

010 


262 

000 

000 

010 

110 

100 

, * 

264 

000 

000 

Oil 

111 

111 


377 



LIFTOFF. SEAL AND BLEED VALVE CONTROL VALVE 

HPOT INTERMEDIATE SEAL PURGE AND FLOWMETER 
BRAKES CONTROL VALVE ' 

EMERGENCY SHUTDOWN CONTROL VALVE 

SENSOR CHECKOUT 

SPARK IGNITER CHECKOUT 

STATUS REQUEST 

COMMAND CHANNEL 1 INHIBIT 

COMMAND CHANNEL 2 INHIBIT 

COHIAND CHANNEL 3 INHIBIT 

COMMAND CHANNEL 1 ENABLE 

COMMAND CHANNEL 2 ENABLE 

COMMAND CHANNEL 3 ENABLE 

• MESSAGE REJECT 


• - NOTES : 

1. Commands Thrust Level between 50 and 109 percent NPL in one percent increments. 

2 . Commands Mixture Ratio between 5.5 and 6.5 in 0.05 unit increments. 

3. Codo transmitted to vehicle from engine if voted command is determined invalid. 
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REF. Absolute commands will agree exactly in content for 

224 

all operable command channels. Voting with 3 good channels, 

2 of 3 agreement will constitute a good vote. After first 
channel failure, 2 out of 2 agreement will constitute a good 
vote . 

The variable command which is executed, assuming that 
all 3 channels are good, will be the average of all 3 vari- 
able commands after it has been determined that all three 
are within a TBD percentage difference of each other. After 
the first channel failure, an average of 2 variables will 
be made to a variable TBD percentage difference. Command 
values which are outside this limit will be disregarded. 

The interval between successive commands from the 
vehicle to the controller will be a minimum of 2 milliseconds. 
The number of commands from the vehicle to the controller 
will not exceed 3 commands for a 20 millisecond period. 

Command Echoes to Vehicle . Commands from the vehicle 
will be echoed twice by the controller. Commands will be 
echoed immediately, upon receipt of a command, on each 
individual command channel exactly as received from the 
vehicle. Concurrent with the individual channel echo and 
commensurable with the allowable skew between command chan~ 
nels, the controller will initiate voting of commands from 
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REF. all operable command channels. A validated command will 
224 

result in the transmission of the voted command to the 
vehicle to indicate message acceptance by the controller. 
Conversely, a command which is voted and determined to be 
invalid by the controller due to disagreement or incorrect 
phase of engine operation, will result in the transmission 
of a “message reject" code to the vehicle indicating the 
command has been rejected. The transmission of either the 
voted command or message reject code will occur within 400 
microseconds of receiving absolute type command words from 
all operable, channels. The transmission of either the 
• voted command or message reject code will occur within 

600 microseconds of receiving variable type command words /;* 
from all operable channels. All command word echoes will 
be transmitted on all command channels. The design of the 
controller will be such that, if in the future the command 
echo requirement is removed, the controller operation would 
not be degraded. 

Execute Command . All commands from the vehicle, except 
the "status request" command, will be implemented with a 
"command execute" command. The command execute will be 
received from the vehicle within 200 microseconds following 
the transmission of the voted command from the controller. 
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REF. The controller will implement the most recent command which 
224 

has been received and accepted prior to the command execute. 
Implementation will be concurrent with the transmission to 
the vehicle which indicates acceptance of the command execute. 

Engine Status Data to Vehicle . The parameters listed 
in Table 4.20-6 Engine Status Transmitted to Vehicle, will 
be transmitted to the vehicle from the controller via the 
command channels in response to a "status request" command 
word. A command execute word is not required to initiate 
the transmission. The transmission of the parameters will 
be initiated immediately following the transmission of the 

l 

voted status request echo. The format of the engine status 
data will be as shown in Figure 4.20*2 and Table 4.20-7 
and will be transmitted on all command channels. 

Word 4 of Tables v.20-6 and 4.20-9 is a failure iden- 
tification of the items listed in Table 4.20-8 Failure 
Identification. Word 5 is an identifying test number associ- 
ated with word 4 and shall include information concerning 
the number of failures experienced. This will not be 
limited to failures which cause redundancy switching but 
all detectable failures. Word 6 of Tables 4.20-6 and 
4.20-9 is a parameter value associated with information 
contained in words 4 and 5. The data interval listed in 
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DATA 


DATA SCALED PRECISION 

WORD RANGE OF DATA 


ENGINE STATUS ' 
i MIXTURE RATIO 
THRUST 

! FAILURE IDENTIFICATION 
TEST NUMBER OF DATA WORD NO. 4 
PARAMETER VALUE OF DATA WORD NO. 4 




0-8 ± 1 * 

0-520K ±6K lbs. 


NOTES: 

1. THIS DATA PROVIDED TO VEHICLE VIA COMMAND CHANNELS IN RESPONSE 

TO A STATUS REQUEST COMMAND. ■ ■ 

2. THESE 6 WORDS SHALL BE ‘OBTAINED FROM SAME DATA TABLE AS FIRST 8 
WORDS OF TABLE X. 


THRUST ANn MIXTURE RATIO VALUES ARE 15 BIT WORDS. 




DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE NO. 4-388 

REV. 

BINGHAMTON. NEW YORK 

REP. NO. 


KEf. 

225 TABLE 4.20-7 ENGINE STATUS WORD 




PHASE (3 BITS* 


SELT TEST 

STATUS (LAST 2 BITS) 1 

1 . 

BIT OOOE 

PHASE NAME 

ITT CODE 

ENGINE STATUS 

i 

000 

(NOT USED) 

00 

(NOT USED) 

j 

001 

GROUND CHECKOUT 

01 

ENGINE OK | 


010 

START PREPARATION 

10 

• COMPONENT FAILED ! 


Oil 

START 

11 

ENGINE LIMIT EXCEEDED 


100 

KAXNSTACZ 




101 

SB7TOOWN 




110 

POST SHUTDOWN 




111 

(SPARE) 




kooc »r rxxsc u bits) 


IBMt •> 

- GROUND 

START 

truer 

MAIN STAGE 

SHUTDOWN 

TOST- 

BIT COSE 

CHECKOUT 

PREPARATION 




SHUTDOWN 


COO -a NOT USED 


001 

STANDBY 

: 

PURGE 

SEQUENCE BO. 1 

I 

START 1 

INITIATION 

NORMAL 

CONTROL 

THROTTLING 
TO KPL 

STANDBY 

010 

AUTOMATIC 

PURGE 

CLOSED LOOP 

THRUST 

KPL TO 

OXIDIZER ! 


CHECKOUT 

SEQUENCE BO. 2 

THRUST CONTROL 

LIMITING 

ZERO THRUST 

DUMP i 

j 

Oil 

CHECKOUT 

PURGE 

THRUST 

. FAIL SATE . 

PROPELLANT 

TUEL j 


COMPLETE 

SEQUENCE HO. 3 

LIMITING 

ACTUATOR 

LOCKUP 

valves' CLOSED 

DUMP 

1 

j 

100 

COMPONENT 

CHECKOUT 

PURGE 

SEQUENCE KO. 4 

TAIL SATE 
ACTUATOR LOCKUP 

(SPARS) 

PAIL SATE 
PNEUMATIC 

> 

ABORT TURNAROUND 
SEQUENCE NO. i 

101 

SEQUENCE ^ 
CHECK 

ENGINE PS Aar 

(SPARE) 

(SPARS) 

(SPARE) 

ABORT TURNAROUND 
SEQUENCE NO. 2 

110 

(SPARE) 

{SPARE) 

(SPARS) 

(SPARE) 

(SPARE) 

ENGINE READY 

111 

(SPARE) 

(SPARE) 

(FPARE) 

(SPARE) 

(SPARE) 

(SPARS) j 


EXAKPIZ or WORD CODE ASD INTERPRETATION 
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224 TABLE 4.20-8 FAILURE IDENTIFICATION 

1. Controller Channel 1 

2. Controller Channel 2 

3. GN2 Purge Control Valve 

-4. Fuel System -purge Control Valve 

5. Emergency Shutdown control Valve channel 1 

6. Emergency shutdown control Valve Channel 2 

7. Invalid Vehicle Command 

8. Liftoff Seal and Bleed Valve Control Valve 

9. Pressure Actuated Fuel Bleed Valve 

10. Pressure Actuated Oxidizer Bleed Valve 

11. High Pressure Oxidizer Turbopump Intermediate Seal Purge and 
Flowmeter Brakes Control Valve Channel 1 

12. High Pressure Oxidizer Turbopump Intermediate Seal Purge and 
Flowmeter Brakes Control Valve Channel 2 

13. Oxidizer System Purge Pressure Sensor ~ 

14. Fuel System Purge Pressure Sensor 

15. Fuel Liftoff. Seal and Bleed Valve control Pressure Sensor 

16. Oxidizer Bleed Valve Control Pressure Sensor 

j 17. High Pressure Oxidizer Turbopump Intermediate Seal Purge and 
Flowmeter Erakes Pressure Sensor Channel' 1 

18. High Pressure Oxidizer Turbopump Intermediate Seal Purge and 

\ Flowmeter Brakes Pressure Sensor Channel 2. 

19. Fuel Preburner Igniter Channel 1 

20. Fuel Preburner Igniter Channel 2 

* 

21. Oxidizer Preburner Igniter Channel 1 

22. Oxidizer Preburner Igniter Channel 2 
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224 TABLE 4.20-8 FAILURE IDENTIFICATION (cont'd.) 

23. Main Combustion Chamber Igniter Channel 1 

24. Main combustion Chamber Igniter Channel 2 

25. Main Fuel Valve Actuator Channel 1 - 

26. Main Fuel Valve Actuator Channel 2 

27. Main Oxidizer Valve Actuator Channel. 1 

28. Main Oxidizer Valve Actuator Channel 2 

29. Main Combustion Chamber Coolant Valve Actuator Channel 1 

30. Main Combustion Chamber Coolant Valve Actuator Channel 2 

31. Fuel Preburner Oxidizer Valve Actuator Channel 1 

32. Fuel Preburner Oxidizer Valve Actuator Channel 2 

33. * Oxidizer Preburner Oxidizer Valve Actuator Channel 1 

34. Oxidizer Preburner Oxidizer Valve Actuator Channel 2 

35. Spare 

36. Spare 

37 . Spare 

t . 

38. Spare 

39. Spare 

J 40. Spare 1 . 

41. Spare 

J '• . \ • ' . ■ - 

1 42. Spare 

43. Low-Pressure Fuel Turbopump Discharge Pressure Sensor No. 1 
Channel 1 

44. Low-Pressure Fuel Turbopump Discharge Pressure Sensor No. 1 
Channel 2 








THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

BINGHAMTON. NEW YORK 

ref. 

224 TABLE 4.20-8 FAILURE IDENTIFICATION (con t’d.) 

45. Low-Pressure Fuel Turbopump Discharge Pressure Sensor No. 2 

Channel 1 . 

46. Low-Pressure Fuel Turbopump Discharge Temperature Sensor No. 1 
Channel 1 

47. Low-Pressure Fuel Turbopump Discharge Temperature Sensor No. 1 
Channel 2 

48. Low-Pressure Fuel Turbopump Discharge Temperature Sensor No. 2 
Channel 1 

49. Low-Pressure Fuel Turbopump Shaft Speed Sensor 

50. High Pressure Oxidizer Turbopump Turbine Seal Purge Pressure 
Sensor 

51. Low-Pressure Fuel Turbopump Radial Vibration Sensor 

’ 52- .Fuel Flowrate Sensor No. 1 Channel 1 

53. Fuel Flowrate Sensor No. 1 Channel 2 

54. Fuel Flowrate Sensor No. 2 Channel 1 

55. Spare 

j 56. Fuel Preburner Temperature Sensor NO. 1 
57. Fuel Preburner Temperature Sensor No.''“ 5 2= i =^ 

, 58. Fuel Preburner Chamber Pressure Sensor 

| 59. High-Pressure Fuel Turbopump Discharge Pressure Sensor 

■ . * ■ * 

60. Spare 

| 61. High-Pressure Fuel Turbopump Shaft Speed Sensor Channel 1 

62. High-Pressure Fuel Turbopump Shaft Speed Sensor Channel 2 

. 63. High-Pressure Fuel Turbopump Radial Vibration Sensor 

j 64. Full Preburner Longitudinal Vibration Sensor 


4-391. 
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REF. 

224 


TABLE 4.20-8 FAILURE IDENTIFICATION (cont'd.) 


65. 

66 . 

67. 

68 . 

69. 

70. 



71. 

72. 

73. 


74. 


75. 


76. 

77. 

j 78. 

! 

! 79. 
80. 


81. 



82. 


83. 


Low-Pressure Oxidizer Turbopump Discharge Pressure Sensor ' 

Channel 1 

■ i 

Low-Pressure Oxidizer Turbopump Discharge Pressure Sensor 
Channel 2 ’ 

•Low-Pressure Oxidizer Turbopump Shaft Speed Sensor 

Spare ’ 

Low-Pressure Oxidizer Radial Vibration Sensor 

High-Pressure Oxidizer Turbopump Discharge Pressure Sensor No. 1 
Channel 1 

High-Pressure Oxidizer Turbopump Discharge Pressure Sensor No. 1 
Channel 2 

High-Pressure Oxidizer Turbopump Discharge Pressure Sensor No. 2 
Channel 1 

High-Pressure Oxidizer Turbopump Discharge Temperature Sensor No. 1 
Channel 1 

High-Pressure Oxidizer Turbopump Discharge Temperature Sensor No. 1 
Channel 2 

High-Pressure Oxidizer Turbopump Discharge Temperature Sensor No. 2 
Channel 1 

High-Pressure Oxidizer Turbopump Shaft Speed Channel 1 

High-Pressure Oxidizer Turbopump Shaft Speed Channel 2 

High-Pressure Oxidizer Turbopump Boost Stage Discharge 
Pressure Sensor - 

High-Pressure Oxidizer Turbopump Radial Vibration Sensor 

Oxidizer Preburner Temperature Sensor No. 1 

Oxidizer Preburner Temperature Sensor No. 2 

Oxidizer Preburner chamber Pressure Sensor 

Oxidizer Preburner Longitudinal Vibration Sensor 
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224 



TABLE 4.20-8 FAILURE IDENTIFICATION (cont'd.) 

CD 

X5 

• 

Oxidizer Flowrate Sensor No. 1 Channel 1 


85. 

Oxidizer Flowrate Sensor No. 1 Channel 2 


86. 

Oxidizer Flowrate sensor No. 2 Channel 1 


87. 

Spare ' - . . 


« 

CO 

CO 

Oxidizer Tank Pressurant Pressure Sensor Channel 1 

89. 

Oxidizer Tank Pressurant Pressure Sensor Channel 2 

} 

90. 

Main 

Combustion Chamber Fuel Injection Pressure 

Sensor 

91. 

Main 

Combustion Chamber Pressure Sensor No. 1 Channel 1 

92. 

Main 

Combustion Chamber Pressure Sensor No. 1 Channel 2 

93. 

Main 

Combustion Chamber Pressure Sensor No. 2 Channel 1 

94/ 

Main 

Combustion Chamber Coolant Temperature Sensor 

: 95. 

Main 

Combustion Chamber Coolant Pressure Sensor 


96. 

Main 

Combustion Chamber Longitudinal Vibration 

Sensor 

97. 

Hydraulic System Pressure Sensor Channel 1 


CO 

* 

Hydraulic System Pressure Sensor Channel 2 


; 99. 

Control^jr Internal Temperature Sensor Channel 

1 

o 

o 

. 

Controller Internal Temperature Sensor Channel 

2 

- -j 101. 

Controller Internal Pressure Sensor Channel 1 


102. 

* 

Controller Internal Pressure Sensor Channel 2 


| 103. 

Vehicle/Engine Command Channel 1 


0 

o 

Vehicle/Engine Command Channel 2 


105. 

Vehicle/Engine Command Channel 3 


O 

O' 

e 

Spare ;•••-• • 


107. 

Oxidizer Inlet Pressure Not Ready 
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224 TABLE 4.20-8 FAILURE IDENTIFICATION (cont’d.) 


108. Oxidizer Inlet Temperature Not Ready 

109. Fuel Inlet Pressure Not Ready 

: '110. Fuel Inlet Temperature Not Ready 

111. Hydraulic System Pressure Out of Limits 

112. Vehicle/Engine Recorder Channel 1 

113. Vehicle/Engine Recorder Channel 2 

114. Vehicle 4-00 Hz Power Bus No. 1 

115. Vehicle 400 Hz Power Bus No. 2 

116. . Spare 

117. Fuel Preburner Temperature Out of Limits 

118. Oxidizer Preburner Temperature Out of Limits 

119. High-Pressure Fuel Turbopump Shaft Speed Out of Limits 

120. High-Pressure Oxidizer Turbopump Shaft Speed Out of Limits 

121. Main Combustion Chamber Pressure Out of Limits 

122. Oxidizer Heat Exchanger Pressure Drop Out of Limits 

123. High Pressure Oxidizer Turbopump Interme*diate Seal Purge 

; and Flowmeter Brakes Pressure Out of Limits ; • 

• • ... * i 

124. and greater are Spares • 

. \ 

i NOTE: Channel Includes Sensor, Harness, Connectors 

and Controller Input or Output Electronics. 
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REF. Table 4.20-9 will be alterable by modification of the con- 
224 

troller's software program. 


Data to Vehicle for Recording . The controller will 
initiate a transmission of the parameters listed in Table 
4.20-9 Data Transmitted to Recorder to the vehicle on the 
recorder channels every 40 plus or minus 2 milliseconds. 

The transmission of recorder data will not be interrupted 
by command words from the vehicle. The data words for 
recording will consist of 15 bits plus a parity bit per 
word. The number of logical "ones" in the data word, includ- 
ing the parity bit will sum to an odd number. The relation- 
ship of the vjord sync pulse, data bits, and parity bit will 
be shown in Figure 4.20-2 and will be transmitted on all 
recorder channels. A "no data" message will be all zeros. 

Operational Capability . The controller will be 
capable of full operation with the vehicle after the vehicle 
interface has experienced one failure (Fail Operational). 

The controller will continue operation in accordance with 
the most recent valid command after the vehicle interface 
has experienced a second failure (Fail Safe). The electron- 
ics interfacing with the vehicle in the controller must 
satisfy the requirement of no-single-point-failure (Fail 
Safe Design). Each failure in the receipt of a ccasnand 
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REF. word from the vehicle will be duly reported in the failure 
224 

identification provision in the transmission of engine status 
data and recorder data to the vehicle. The appropriate 
number will be inserted in the failure identification word. 
The number of occurrences will be contained in the test 
number word. Three consecutive transmission failures on 
any command channel will cause that command channel to be 
disqualified by the controller and the vehicle will have 
the capability to reset the command channel. 

Command Validation . The command words from the vehicle 
to the controller will be verified by: 

(a) Correct number of bits per word 

(b) Parity check for each word 

(c) Direct vote of all operable inputs 

(d) Command execute word 

The number of bits in each command word will include the 
parity bit and will equal 16 bits. The parity check of 
each word will sum the number of logical ’’ones' 1 in a word, 
including the parity bit, to be an odd number. Command 
words from the vehicle which do not pass the number of 
bits per word or parity check will be disregarded and 
inhibited from entering the voting. Command words, which 
are received from the vehicle but not implemented with a 
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224 

a new command word. 


Command Channel Control . The controller will be 
capable, upon command of the vehicle, of disqualifying any :-;l 
single command channel which is found to be in error. 
Conversely, the controller will be capable, upon command 
of the vehicle, of removing the inhibit to any single 
command channel. Command words from the vehicle, to dis- 
qualify and restore individual command channels, will! be 
via remaining operational command channels. 

Intervals Between Transmissions . Command words 
consisting of a word sync pulse with the data bits and 
parity bit equal to logical "zero" will be received from 
the vehicle whenever any command listed in Table 4.20-4 
Vehicle to Engine Commands is not being transmitted. 
Transmissions to the vehicle during periods of inactive 
transmission of engine status, command word echo, or 
recorder data, will consist of data words containing a 
word sync pulse with the data bits and parity bit equal 
to logical "zero". 
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Sensor Input/Output Interfaces . The controller will 
conform to the requirements of this specification when inter- 
faced with sensors having the following characteristics when 
installed on the engine. Sensor ranges and levels of 
redundancy w.il.1 be .as .specified in Table 4.20-10 Sensor 
Ranges and Redundancy Levels. 


(a) Pressure Sensors : 

Input Impedance: 1250 to 2500 ohms at 75F. Change with 

temperature, 0.4 percent per 100F. 


Output Impedance: 


1500 plus or minus 150 ohms at 75F. Change 
with temperature,. 0.4 percent per 100F. 


Excitation Voltage: 


10.00 plus or minus 0.025 volts dc 


Output Voltage Range: 0 to 30 millivolts dc (nominal) 

Error Band: plus or minus 0.6 millivolts dc from 

nominal straight line 

Frequency Response: Greater than 600 rad per sec (equivalent 

first order) 

Sensor Repeatability.:; Readings taken on each sensor under the same 

pressure conditions will repeat within plus or 
• . minus 0.87 percent of the NPL reading at all 

applicable environmental conditions. This 
is equivalent to plus or minus 0.75 percent 
■ . of sensor full scale range. Individual 

: sensor calibration constants, derived from 
curve fitting equations, will be supplied 
for the software program defined in RC1010. 

The form of the equation is: 

y = a 0 + a,X '«■ a 2 X 2 * . . . ♦ a^X* 
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TJTTT' oo/. 

• A. t-r 


(b) Tem perature Senso rs: 

Sens'or Output: R r /R Q = 1^ a [ (T - 6 T (T-100) /10*) - 8 T 3 (T- 100) /10® ] 

f «# 

where: T = Temperature in Centigrade 

a = 0.00391 to 0.0039275 
6 = 1.492 ± 0.07 
$ = 0.11 ± 0.035 

R^= Sensor resistance at T (ohms) 

R 0 = Sensor resistance at 0C 

=. 50±1, 200±2, 1380±3, or 5000±10 ohms 
as specified in Table ' 4 . 2 Q -10 

2 milliamperes dc maximum 


Sensor Excitation 
Current: 

Sensor Response: 


Sensor Repeatability: 


Equivalent first- order time constant of 0.5 
sec for sensors with R 0 of 50 and 200 ohms; 
0.1 sec for sensors with R 0 of 1380 and 5000 
ohms at the engine operating flowrate 
conditions 

Readings taken on each sensor under the same 
temperature conditions will repeat within 
plus or minus 0.25 percent of the measurement 
span at all applicable environmental condi- 
tions. Individual sensor calibration 
constants, derived from curve fitting equa- 
tions, will be supplied for the software 
program defined in RC1010. The form of the 
equation is: 


y = a, 


♦ a X ♦ a X2 
1 2 


a, X 6 
6 


< 
co I 
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REF. 224 

(c) Fl o w Sensors 
Sensor Coil Resistance: 
Sensor Coil Inductance: 


1500 ohms maximum . 

1.0 henry maximum at 1 K Hz 


i 

i 


Sensor Output Voltage: 0.2 minimum to 10.0 maximum 

.(Peak to Peak) (Eased on resistive load of 

10 plus or minus 2 K ohms) 
over the frequency range of ; 
5 to 500 Hz. 

Flowmeter Frequency Greater than 200 rad per sec 

Response: (equivalent first order) 

3 Sigma Precision: ' plus or minus 0.45 percent of j 

reading at all applicable 
environmental conditions 

Pulse characteristics for flow sensor outputs are TBD. 

(d) Pos ition s e nsors - Servo Va l ves a n d Bleed Valves 

i 

20 milliamperes maximum 

20 volts peak-to-peak 
(nominal) 

2000 plus or minus 100 Hz j 


minus 0.25 to plus 0.25 volts 
peak-to-peak (nominal) 
when operating into a 10 K 

ohm resistive load 

• ! 

■ ■ • i 

plus or minus 0.5 percent of 
point plus or minus 1 

0.5 percent full scale 
deviation from nominal 
' straight line 

F nT, sor Output Phase 0 to 5 degrees 

Shift: 


Sensor Primary Current: 

Sensor Excitation 
Voltage: 

Sensor Excitation 
Frequency: 

Sensor Output Range: 


Sensor Error Band: 


I 
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(e) Vib ration Sensors 

Sensor Source Capaci- 2000 picofarad minimum 

tance: 

Sensor Output Voltage: 5.0 plus or minus 0.7 milli- 

volt RMS per g RMS operating 
into a load of 300 picofarads 
in parallel with 100 megohms. 


Sensor Frequency Range: 1 Hz to 6 K Hz (300 g) for 

radial (turbopumps) 

100 Hz to 15 K Hz (1000 g) for 
longitudinal (combustors) 

Sensor Frequency Re 
sponse: 


Greater than 10 K Hz 
(equivalent first order) 


Vibration sensors are for the purpose of obtaining and recording engine 
maintenance trend data. Controller input circuits for the longitudinal 
vibration sensors shall be capable of selectively sampling predetermined 
frequency windows throughout the frequency range of the sensor. 

Controller input circuits for the radial vibration shall be sensitive 
to a narrow frequency band centered about the fundamental rotating 
frequency of the appropriate turbopump. Vibration sensor inputs shall 
be demodulated and sampled at a frequency rate sufficient to satisfy 
the data requirements for the vibration parameters listed in Table' 4.20-9 
Data Transmitted to Recorder. 
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(f) Pos ition S e nsors - Hydraul i c Actuato rs 

Sensor Primary Current: 20 milliamperes maximum 

Sensor Excitation 20 volts peak-to-peak 

Voltage: (nominal) 

Sensor "Excitation 2000 plus or minus 100 Hz. 

Frequency: 

Sensor Output Range: 0.25 to 4.75 volts 

peak-to-peak (nominal) 

, .when operating into a 10 K 

ohm resistive load 

Sensor Error Band: plus or minus 0.5 percent of 

point plus or minus 0.5 
r, percent full scale deviation 

from nominal straight line 

Sensor Output Phase 0 to 5 degrees 

shift:-.' ■ ’ 

. (g) Speed Sensors 

Sensor Coil Resistance: . 1500 ohms maximum 

Sensor Coil Inductance: 0.1 henry maximum at 1 K Hz 

Sensor Output Voltage: 0.2 minimum to 16.0 maximum 

(Peak-to-Peak) (Based on resistive load of 

10 plus or minus 2 K ohms) 

Sensor Output Frequency 4J)0_Hz to 10 K Hz 

Range: 

Pulse characteristics for speed sensor outputs are TBD. 

(h) Leak D etection Sensors \ • / 

Leak detection sensors may be added at a’ later date. Since sensor and 
circuit characteristics are not defined, space equivalent to 80 square 
inches of circuit board shall be reserved. 
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REF. Igniter and Control Devices Interface . The controller 

224 

will conform to the requirements of this specification when 
interfaced with igniters and control devices having the 
following characteristics when installed on the engine. 


(a) Servoactuators 

Servovalve Load Resistance; 

Servovalve Current Range ; 

Actuator Closed-Loop Frequency 
Response; (Equiv. second order); 

Main Oxidizer Valve Area; 

Oxidizer Preburner Oxidizer 
Valve Area : 

Fuel Preburner Oxidizer Valve 
Area: 

Combustion Coolant Valve Area; 

Actuator Closed-Loop Damping Ratio: 

Actuator Closed-Loop Threshold : 

Actuator ^Closed-Loop Slew Rate; 

Main Oxidizer Valve Area: 

Main Fuel Valve Area; 

Oxidizer Preburner Oxidizer Valve 
Area?: 


500 ohms max. 

± 20 milliatnperes dc 

4 to 10 Hz 

12 to 20 Hz 

12 to 20 Hz 
12 5o 20 Hz 
0.5 minimum 
1% full scale max. 

150 to 300%/ perosecond 
250 td 400% per second 

150 to 250% per second 


Fuel Preburner Oxidizer Valve 
Area: 


Combustion Coolant Valve Area: 


150 to 250% per second 
150 to 250% per second 
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REF. (b) Solenoid Valves (Non-hatching) 

224 

Coil Current (Energizing):. 1 ampere dc max. 

Coil Current (Holding): 0.5 ampere dc max. 

Coil Voltage (On): 26 volts dc max. 

Valve Response Time: 

Pneumatic “ Electrically Actuated: 20 milliseconds max. 
Pneumatic - Pressure actuated: 50 milliseconds max. 

Hydraulic Actuator Solenoids: 14 milliseconds max. 

Coil Inductance: 0.05 to 0.3 henries 

Valve response time is defined as the time interval from the 
application of the electrical signal to the completion of 
the travel of the actuated device. 


(c) Spark Igniters 

Igniter Power Supply Current (On) : 1 ampere dc max. 

Igniter Control Current (on): 50 milliamperes dc max. 

Igniter Voltage (On): 26 volts dc max. 

The servoactuators and solenoid coils will be driven by 
current sources. The controller will*contain networks to 
suppress electrical transients and protect solenoid coil 
driver circuits. The spark igniters will be driven by voltage 
sources. The solenoid valve and igniter control current in 
the off-state will not exceed 5 milliamperes dc and 1 milli- 
ampere dc, respectively. 
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ref. 4.20.3.3 GROUND EQUIPMENT INTERFACE 
224 

The controller shall contain ground support equipment 
(GSE) interface connections in accordance with RC1009. The 
GSE interface will be capable of duplicating the commands 
and data transmission normally provided through the vehicle/ 
engine electrical interface, and the controller will be 
capable of operating the engine while installed on the 
vehicle through this GSE interface. Controller electrical 
power will be supplied through the vehicle power interface 
during this mode of operation. The GSE interface will con- 
tain provisions for complete reprogramming and verification 
of the controller memory without removing the controller 
from the engine. The controller design will preclude accept- 


ance of commands from the vehicle /engine electrical interface 


when the GSE interface is connected to operating external 


ground equipment. 


< 
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4.20 

4 controller hardware 

4.1 INPUT ELECTRONICS DESCRIPTION 



The input electronics (Figure 4.20-3) receive analog 
and pulse rate signals from all inflight sensors, including 
temperature, pressure, vibration, position, rotational speed 
and flow rate. Built-in test signals from other portions 
of the controller are also received. The incoming signals 
are "conditioned" by amplification, filtering and/or demodu- 
lation and then converted to digital form suitable for the 
computer. Data from nonflight sensors for test stand 
requirements are not processed through the input electronics. 

Because two independent digital computers are necessary 
for fail-operational/fail-safe performance, two sets of input 
electronics are provided. One set of input electronics is 
assigned to each digital computer. These sets are designated 
as Number 1 and Number 2. 

In addition, each of the two sets of electronics 
contains three redundant data channels, designated A, B, and 
C, to match the triple redundant inputs from the performance 
control sensors (see Figure 4.20-4). Inputs from dual 
redundant limit control sensors, non-redundant maintenance 
data sensors, and built-in test are distributed among the 
three data channels in a manner which preserves redundancy 
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REF. and at the same time achieves equality of signal flow between 
42 

the channels. The latter is significant because it minimizes 
data processing time and achieves a fast high response 
sampling rate. Each of the three data channels in a set of 
input electronics processes approximately one-third of all 
the engine inflight sensor outputs. 

Input Channel Function 

The basic function of each input channel is to convert 
the analog and pulse rate sensor and built-in test signals 
to digital form. In order to handle the many pieces of data 
from multiple sensors with a minimum of hardware, each channel 
samples or multiplexes the data in a time sequence. Each 
input is sampled once every 20 msecond operating cycle, 
conditioned, converted to digital format, and sent to the 
computer interface electronics. 

The signal conditioning and conversion functions for 
a typical data channel are shown in Figure 4.20-5. To 
minimize hardware costs, all data channels are identical. 

The only functional differences are minor variations in the 
quantities and types of inputs to each channel to accommodate 
the requirements for sensor redundancy. 
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REF. Each input channel hast the following additional 

42 

functions: 

1. Distributes redundant dc excitation voltages to 
the temperature and pressure sensors, and provides 
reference voltages to the analog-to-digital 
converters . 

2. Generates signals for self-calibration. 

3. Provides test signals and switching for sensor 
calibration and integrity checks. 

4. Accepts analog built-in test inputs from power 
supply and output electronics. 


Each input data channel is independently supplied from 
two sets of redundant power supply regulators. Sensor 
excitation and converter reference voltages are supplied 
from the^saroe regulators used to power the respective elec- 
tronics to take advantage of the resulting cancellation of 
errors from power supply voltage variations. Failure of a 
data channel or its regulated power supplies will not propagate 
into another channel. Figure.' 20-5 presents a complete 
discussion of power supply decoupling and redundancy. 
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REF Types of Inputs 

42 

Two categories of inputs are processed: one is analog 

and the other is a variable pulse rate where the voltage 
amplitude and the pulse rate, respectively, are proportional 
to the measured parameter. 

Analog temperature, pressure, vibration, position, and 
built-in test signals are conditioned through low-level 
multiplexer gates, amplifiers, and/or modulators to achieve 
a common scale factor. As shown in Figure 4.20-5, these are 
then gated through a high-level multiplexer to the analog-to- 
digital converter. The analog-to-digital converter trans- 
forms the high-level multiplexer analog outputs to digital 
words. Parallel sequencing of the analog-to-digital conver- 
sion in all three channels is regulated by the computer 
interface electronics through a common control in each set 
of electronics. At fixed intervals, when a conversion is 
complete, the three data channel digital outputs are trans- 
ferred sequentially by the computer interface electronics 
to the computer to update the memory. The transfer is com- 
pleted ini memory cycle (1 microsecond). Data transfer of 
sensor and built-in test values continues until all inputs 
have been sampled. The process is repeated every 20 msec 
for a new sampling cycle. 
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REF. A common control unit associated with each set of 

42 

input electronics regulates the sequencing of the multiplex- 
ing and the analog-to-digital conversion in the three 
associated data channels by decoding control. signals from 
the computer interface electronics. 

T.ow-lc- Low-level multiplexing reduces the number of components 
by requiring a single high-gain amplifier for up to eight 
temperature or pressure inputs. It also improves performance 
by permitting calibration and reference signals to be multi- 
plexed through the high-gain amplifiers to check and correct 
amplifier gain and offset. Normalizing all the high-level 
multiplexer inputs to a common scale factor reduces the 
number of multiplexer components by a factor of 2. 

Pulse rate shaft speed and flow rate signals are con- 
verted directly to digital format by measuring the pulse 
period with a high frequency precision clock signal. This 
yields the reciprocal of the measured parameter. Each pulse 
rate input is processed through a separate converter. When 
a conversion is complete, the computer interface electronics 
transfer the data to the computer in 1 microsecond to update 
the memory. 
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REF. Analog Signal Processing 

42 

Processing of . the various analog inputs for a typical 
channel shown in Figure 4.20-5 is as follows: 

1. Temperature sensor dc inputs to each channel are 
processed through a corresponding number of low-level multi- 
plexer gates to one common programable-gain amplifier. A 
reference ground is multiplexed into the amplifier just prior 
to each sensor signal. This improves accuracy by erasing 
residual signals from prior inputs. Sensor operating range 
and range midpoint values are multiplexed simultaneously with 
each sensor input to adjust the amplifier gain and offset for 
maximum dynamic scaling. The high-gain amplifier output is 
gated through the high-level multiplexer to the ana log- to- 
digital converter. 

2. Pressure sensor dc inputs are processed in a manner 
similar to those of temperature sensors. The number of inputs 
to each high-gain amplifier is limited to ensure that gate 
leakage does not adversely affect the 'precision of the low- 
level pressure signals. 

3. Vibration sensor ac inputs are individually ampli- 
fied, filtered, and multiplexed directly through the high- 
level multiplexer to the analog-to-digital converter. The 
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REF. amplifier is operated in the current mode to protect the 
42 

high-impedance, lowrlevel signal from electrical noise pickup 
in the engine or in the controller. In this mode the signal 
from the sensor feeds directly to the input of an operational 
amplifier acting as a charge integrator. 

4. Linear position sensor ac inputs are demodulated 
to an analog voltage, scaled, and multiplexed directly to 
the analog- to-digital converter. The use of an operational 
amplifier and full-wave synchronous demodulation provides 
good accuracy and high-frequency response. 

5. Analog built-in test signals from the output 
electronics and the power supply electronics are gated 
through the high-level multiplexer to the analog- to-digital 
converter. Calibration signals to verify the operation and/ 
or accuracy of the input electronics are supplied in accord- 
ance with Table 4.20-11. The measured outputs are used by 
the computers to continuously recalibrate the input 61ec- 

tronics by automatic software changes*. 

# 

“Digital output word format is 12 bits from the analog- 
to-digital converter. Twelve bits provide a resolution of 
one part in 4095 or 0,025 percent, which is more than 
adequate to meet engine accuracy requirements. Total 
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TABLE 4.20*11 INPUT ELECTRONICS CALIBRATION 


r 



TEST SIGNAL 

- 

. . 

USAGE 

FUNCTION 

TYPE 

input • 

OUTPUT* - 

PARAMETER 

MEASURED 

IN 

FLIGHT 

G P.O'JNO 

checkout 

analog to digital 

CONVERTER 

REFERENCE 

VOLTAGE 


HIGH-LEVEL MULTIPLEXER 

ANALOG/DIGITAL (A/0) 
CONVERTER OUTPUT 

CONVERTER CAIN 

X 

. 

X 


REFERENCE 

CROUNG 

HIGH-LEVEL KULTIPLEXER 

A/D CONVERTER OUTPUT 

CONVERTER OFFSET 

X 

X 

HIGH-LEVEL MULTIPLEXER 

REFERENCE 

VOLTAGE 


HIGH-LEVEL MULTIPLEXER 

analog/digital (a/o) 

CONVERTER OUTPUT 

MULTIPLEXER 

OPERATION 

X 

X 

HIGH-GAIN AMPLIFIER 

REFERENCE 

VOLTAGE 

• 

low-level MULTIPLEXER 

A/D CONVERTER OUTPUT 

AMPLIFIER GAIN 

X 

X 


REFERENCE 

GROUND 

low-level multiplexer 

A/0 CONVERTER OUTPUT 

AMPLIFIER offset 

X 

X 

LOW-LEVEL MULTIPLEXER 

REFERENCE 

VOLTAGE 

- 

low-level multiplexer 

A/D CONVERTER OUTPUT 

multiplexer 

OPERATION 

. X 

X 

ACCELEP.AT I O'L AM?L 1 FIER 

REFERENCE 

VOLTAGE 


AMPLIFIER input 

A/0 CONVERTER OUTPUT 

AMPLIFIER GAIN 


X 

LINEAR POSITION 
DEMODULATOR 

0) 


- 


- 


X 

PULSE RATE CONVERTER 

KNOWN FREQUENCY 

REDUNDANT 
SENSOR WINDING 

REDUNDANT PULSE 
RATE CO*>VEP.TER • • 

SENSOR AND CON- 
VERTER OPERATION 


X 


(I) CALIBRATED CL'?. 1ST, BUILT-IN TEST BY CO.MPAR I SIN GF COMMAMDEO POSITION WITH THAT DERIVED FROM DEKDOULATED 
LINEAR VARIASEE DIFFERENTIAL TRANSDUCER FEEDBACK 
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R.EF accuracy of the analog-to-digital converter is -H) ,223 'osrcent 
42 


random and 0.07 percent non-random. 

Analog Signal Control 

All multiplex switching and analog-to-digital conver- 
sions are under the control of the computer interface elec- 
tronics. A conversion cycle is initiated every 200 microsec. 
upon receipt of an 11-bit word from the control unit in each 
set of input electronics (Figure 4.20-4). Eight bits contain 
the addresses of the multiplexer gages to be closed for that 
particular conversion, and 3 bits provide synchronizing 
information.. Control of the multiplexing and conversion 
process occurs in the following sequence: 

1. Receipt of coded control signal by the control. 
Control addresses and closes designated low- and high-level 
gates in the three channels (A, B, and C). Control admits 
timing clock signal to analog-to-digital converters. 

2. Timing circuits initiate analog-to-digital conver- 
sion after a suitable settling time. 

3. Upon completion of conversion (which requires an 
average of 110 microseconds, excluding settling and decoup- 
ling time), each converter sends adata ready signal to the 
computer interface electronics. 







F-398 


date 10/20/72 


REV. 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

B I NGHAMT ON . NEW YORK 


page no.4_425 


REP. NO. 


*5 1 

<0 I 


n Ft? 

aur , 

42 


4. When data ready signals are received from all three 
channels, the computer interface electronics sequentially 
acquires the digital data from the converters. If due to a 
failure, a data ready signal is not received from one or more 
channels within 190 microsec of initiation of the conversion, 
the acquisition is performed on the remaining channels. 

The process is then repeated for a new set of multiplexed) 
signals. All input signals are sampled once every 20 msec. 


Pulse Rate Signal Processing 

Each pump speed or flow rate signal is routed directly 
to its respective pulse-rate-to-digital converter. The pulse 
period is measured by a clock signal to provide an output 
proportional to the reciprocal of pulse rate. Pulse-rate- 
to-digital conversion occurs asynchronously with the analog- 
to-digital conversion. The frequency of conversion is pro- 
portional to the pulse rate. As each conversion is completed, 
a data ready signal is transmitted to the computer interface 
electronics. The output is held in the converter for a period 
dependent upon the incoming pulse rate. The computer inter- 
face electronics has the option of acquiring the output data 
during this period or waiting for the next output if occupied 
with higher priority operations. 
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REF. The pulse-rate-to-digital converter outputs are 16-bit 

42 

words, providing a resolution of 0.015 percent at full scale 
(minimum pulse period) and 0.0015 percent at 10-percent scale. 

4.20.4.2 COMPUTER INTERFACE ELECTRONICS DESCRIPTION 

The computer interface electronics (Figure 4.20-6) 
control data flow to and from the computers. Each of two 
electronic sets (Figure 4.20-7) is dedicated to a computer 
and a set of input electronics performing the functions of: 

1. Transferring the commands and data requests from 
the vehicle /engine data bus interface to the coni- 

j puter, and the data responses from the computer 

to the vehicle /engine data bus. 

2. Controlling the flow of data between the computer 
and the input and output electronics. 

3. Monitoring computer operation by watch-dog timers. 

4. Providing a redundant time reference to the 
digital computer. 

The above functions are performed by groups of circuits 
in each set of electronics, as shown in Figure 4.20-8. These 
are : 
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REF. 1. Data Bus Multiplexer - Provides the communication 
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link between the controller and the vehicle. This communi- 
cation link is bidirectional, receiving commands and data 
requests from the vehicle and transmitting the requested 
data to the vehicle. Commands and data are transmitted via 
-redundant vehicle data 'buses. These data buses interface 
with the controller through Acquisition, Control and Test 
(ACT) units. 

2. Direct Memory Access Input Multiplexer - Processes 
all data entering the computer memory through the direct 
memory access (DMA) input. This includes data from the 
associated set of input electronics and from the data bus 
multiplexer. The DMA multiplexer is triple redundant to 
match the redundancy of the control sensors and their input 
electronics. Multiplexer control is provided by the DMA 
control. 

3. Real Time Clock - Provides the computer with 
redundant time references to initiate, the start of each 
20 msec control cycle. 

i ■) ' , • 

4. Direct Memory Access Control - Controls the flow 
of data in and out of the memory via the DMA data channel. 
Data is transferred into the memory by halting computer 
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42 operations for 1 tnicrosec memory cycle for each data transfer. 
Requests for access to the memory are granted on a priority 
basis. The order of priority is: 

a. Vehicle commands and requests for data. 

b. Analcg-to-digital converter data. 

c. Pulse-rate-to-digital converter data. 

5. Watchdog Timer ** Monitors computer operation to 
verify that it is progressing through its program per a pre- 
determined schedule. Two watchdog timers are used with each 
computer to .ensure fail-safe computer monitoring. 

Data Bus Multiplexer 

The controller interfaces with the vehicle through two 
Acquisition, Control, and Test (ACT) units and a vehicle 
recorder bus (Figure A. 20-8). The ACT units transmit commands 
and data requests to the controller and receive requested 
data from the controller. Engine maintenance data is sent 
by the controller directly to the recorder data bus. One 
ACT unit is normally in control with the other in- standby. 

The data bus multiplexer is capable of communicating with 
either at any time. As all communication with both sets 
of computer interface electronics is identical, only one is 
discussed in detail. 5 
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REF, Each data bus multiplexer has four signal paths with 

42 

the ACT unit: clock, data input, data output and data gate. 

The clock serves to clock the data into and out of the con- 
troller and operates continuously. The data input supplies 
the controller with vehicle commands. The data output 
transmits controller data to the vehicle when enabled by 
the data gate. 

The controller accepts inputs from the two ACT units 
through separate connectors. The vehicle recorder, used to 
record engine maintenance data, has data channels dedicated 
to each engine. The data is transmitted to the recorder bus 
from the controlling computer. 

Direct Memory Access (DMA) Input Multiplexer 

Data from the input electronics and the data bus multi- 
plexer is gated into the memory through the DMA input multi- 
plexer. Each of the two multiplexers (No. 1 and No. 2) 
includes three channels (A, B, and C) that interface with 
the corresponding channels of the input electronics. The 
A channels also interface with their respective data bus 
multiplexers. The functional arrangement of channel 1A is 
shown in Figure 4.20-9. 






DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE 

no '4-433 

REV. 

BINGHAMTON, NEW YORK 

REP. 

NO. 


ref. 

42 



COMPUTER NO. I 
5 .“A e«A' 


Figure 4.20-9 Direct Memory Access Input 

Multiplexer Channel (Typical 
1 of 6) 
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REF. Each of the six multiplexer channels includes one 

42 

12-bit gate for analog-to-digital converter data and seven 
16-bit gates for pulse-rate-to-digital converter data. 

As indicated in Figure 4.20-9, channel 1A (and 2A) include 
an eighth 16-bit gate for data bus multiplexer data. The 
data is gated under 'control -of "the DMA control unit. 

Real Time Clock 

Each computer interface electronics includes redundant 
real time clocks. The function of the clock is to interrupt 
the computer at precise time intervals. As shown in Figure 
4.20-10, each real time clock consists of a four-section 
counter with means for setting time in to and reading time 
out of the counter. This provides the capability of perform- 
ing specific tasks in real-time. 

In normal operation, the counter is incremented by the 
incoming-clock frequency. When the gate becomes true, the 
counter is reset and an external priority interrupt is sent 
to the computer. This interrupts the -computer to increment 
a time location in memory by one. A new cycle is initiated 
when the preset time location overflows from all ones to all 
zeros. At the time of the new cycle, the computer also 
presets the time location and countdown resumes for the 
next cycle. 
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Figure 4.20^10 Real Time Clock (Typical 1 of 4) 
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rate, i.e., when limit monitoring indicates a parameter is 
beyond limits, the computer programs a smaller number into 
the memory time location and the sampling period is propor- 
tionately shorter. 

To ensure that a clock failure will be detected, each 
computer is provided with two real time clocks. The clock; 
dutputs are periodically compared during built-in test, and 
if they differ, appropriate action is taken. 

Direct Memory Access Control 

The function of the direct memory access control unit 
is to regulate the data flow in an orderly manner and in 
accordance with a set order of priorities. To perform this, 
function, the direct memory access control (Figure 4.20-11) 
is organized into a hierarchy of three channels. Each 
channel accepts data requests, memory addresses and control 
signals, and transmits data transfer and memory address 
control signals. Each channel includes the necessary decoders, 
counters, and priority and sequence control logic to perform 
the above functions. i 
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Figure 4.20-11 Direct Memory Access Control 

(Typical 1 of 2) 
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commands and data requests. Upon receipt of a command or 
data request from the data bus multiplexer, the data bus 
control will service the request by providing a memory output 
within 3 microseconds. If either Channel 2 or 3 is trans- 
ferring data, Channel 1 will interrupt at the completion of 
the 16-bit transfer in process and will assume control. 

When the Channel 1 transfer is complete, control will be 
relinquished to the channel with the next highest priority. 
The validated command is transferred to both computers, 
since normally only one ACT unit is operational at a time. 
Data requests from either data bus multiplexer activate the 
DMA control to route the requested data onto the DMA data 
bus by the requesting data bus multiplexer. Channel 2 Analog 
to Digital Converter Control provides second priority control 
for data transfer to memory from the analog-to-digital con- 
verters^- Channel 2 normally receives a data-ready signal 
from each of the three converters when a conversion is 
complete. When the three -signals have been received or when 
a predetermined time has elapsed, the ready data is trans- 
ferred sequentially to dedicated locations. in the memory. 
Memory locations for converters which have not issued a 
data ready signal are coded in the upper four bits to prevent 
the processing of incorrect or obsolete data. Channel 2 
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and has the same priority relationship with Channel 3 as 


Channel 1 with Channel 2. 


Channel 3, Pulse Rate to Digital Converter Control, 
processes pulse rate converter data in a manner similar to 
Channel 2, except that both Channels 1 and 2 have higher 
priority. 


Watchdog Timer 

The watchdog timer (Figure 4.20-12) is a circuit used 
to verify that the computer is progressing through its 
program. The timer is designed to be reset by the computer 
software program within a predetermined time. If the timer 
is not reset within that period, the output will switch from 
a logic one to a zero (failed indication). Reset is initiated 
by instructions within the computer program. Absence of a 
reset and the resultant shift to zero in the timer output 
indicates a computer failure. All computer and timer failure l 
modes result in the watchdog timer output going to zero. To 
avoid the possibility of a failure where the computer 
repeatedly issues reset instructions from the same subroutine, 
two watchdog timers are used with each computer. Each sub- 
routine resets only one of the timers. 
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Figure 4.20-12 Watchdog Timer 

- (Typical 1 of 4) 
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If the computer fails to reset either of its watchdog 
timers, the output goes to zero. A failure indication by the 
watchdog timer for computer No. 1 will cause the output switch 
described in paragraph 4.20.4.4 to transfer control to computer 
No. 2.: Simultaneously, the watchdog timer will issue a con- 
trol signal to the power supply electronics to cause shutdown 
of computer No. 1 power. The shutdown procedure includes a 
HALT instruction to the computer to prevent further processing. 
A failure in No, 2 computer subsequent -to a failure in No. 1 
will cause the No. 2 watchdog timer to remove computer power, 
issue a HALT instruction, and remove power from the output 
electronics to enable a fail-safe shutdown. Each computer 
monitors the watchdog timer output of the other to determine 
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by the controlling computer. 

4.20.4.3 DIGITAL COMPUTER DESCRIPTION 

Two independent digital computers (Figure 4.20-13 and 
4.20-14) receive commands from the vehicle and data from the 
sensors. Each performs the computations necessary for full- 
authority closed-loop control of the engine thrust and 
mixture ratio. Each computer also schedules the sequencing 
commands for all phases of ground and flight operations. 

Normally, computer No. 1 is in control and computer 
No. 2 is in operational standby. In the event of a failure 
in computer No. 1 or its power supply, control is transferred 
to computer No. 2 without impairing engine operation. 

In addition to the primary function of engine control 
each computer performs the following functions: 

1. Accepts maintenance data from the sensors# stores 

~ the information in the memory and transmits it to 

the vehicle upon request. 

t i 

2. Performs continuous self test. 

3. Monitors the performance of the engine sensors, 
igniters, valves, actuators, and the other 
computer. 
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Figure 4.20-13 Digital Computer 
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Figure 4.20-14 Digital Computer Organization 
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REF. 4. Stores sensor calibration constants and uses 

I o . . 

H/L 

them to correct raw sensor data. 


5. Measures and compensates for errors introduced 
into the sensor data by the signal conditioning 
and analog-to-digital conversion circuitry of the 
input electronics. 

Computer Selection 

The Honeywell HDC-601 computer with a plated-wire 
memory is used for the SSME controller application. The 
KDC-601 was selected for the following reasons: 

1. Off the shelf . The HDC-601 is a fully developed 
digital computer and has been in production on two U. S. 

Air Force programs for over six months. Commercial equiva- 
lents, the H-316 and DDP-516, have seen extensive applica- 
tion over the last 3-1/2 years. The HDC-601 is repackaged 
to conform to the controller form factor, but the proven 
logic, direct memory access, printed wiring board layouts, 
support software, and diagnostic and maintenance documen- 
tation are retained intact. . .. 

2. Available: support software cuts costs and schedules . 
The HDC-601 computer is software-compatible with the DDP-516 
and the extensive software system developed for the DDP-516 

is also available for the HDC-601. 
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in the HDC-601 is rugged in construction and is fast because 
of its true nondestructive readout characteristics. The 
contents of the memory are not altered during a readout 
operation and do not have to be restored as is the case with 
-cores. The ^controller ■■computer -uses a 2-mil plated wire 
memory to take advantage of its greater speed and reliability 
and lower power consumption. The word-organized structure 
of the plated-wire memory in conjunction with the nondestruc- 
tive readout makes possible a convenient means of increasing 
system reliability by implementing memory lockout. Memory 
lockout allows that part of memory that contains the oper- 
ational program and program constants to be operated in a 
read-only mode, thus preventing the inadvertent alteration 
of these instructions and constants. 

4. Efficient data transfer . The HDC-601 achieves 
efficient data transfer by providing access to the memory 
through two routes. One is through the customary direct 
input/output processing channel under control of the computer 
program. The other is a direct memory access channel which 
permits independent transfer of data into and out of the 
memory while normal computing operations continue without 
interruption. The customary direct input/output cycle 
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42 

direct memory address requires only 1 microsecond. Since 
120 sensor and 105 analog and digital built-in-test inputs 
(including spares) must be sampled during each 20,000 msec 
period, the 4 to 14 microsec per cycle saving through direct 
memory access frees an additional 1000 to 3500 microsec or 
5 to 17 percent of each sampling period for other operations. 
Stated in another way, the 1-microsecond direct memory access 
makes more than 98 percent of the sampling period available 
for computations. Direct memory access mode of operation 
is accomplished on a memory cycle steal basis. That is, 
requests for access to the memory are granted at the next 
memory cycle on a priority basis. 

5. Real time control . The HDC-601 was designed for 
real time control and meets the requirements for fast, 
efficient, and reliable computations. As previously noted, 
the HDC-601 is an aerospace version of the Honeywell H-316 

and DDP-516 computers, which were designed for and have 

established an excellent record in the field of real time 
control. An important function in a real time control 
system is the capability to interrupt the normal computations 
for priority operations without jeopardizing process control. 
The HDC-601 provides priority interrupts for use by the 
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REF, controller in (1) processing vehicle commands, (2) detecting 
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power failure and initiating action to preserve the engine 
control status, and (3) detecting errors in the output of 
the memory. 

6. Optimum word length . The HDC-601 uses a 16-bit word, 
which is optimum for applications that must encompass both 
control and computation functions. While 12-bit word length 

is sufficient for most control purposes, in certain types of 
computations such as multiplication, accuracy is degraded 
unless the slower double precision mode is used. The 16-bit 
word length in the .HDC-601 provides ample accuracy in the 
single precision mode for virtually all computations. The 
double precision operation is still available for the in- 
frequent operations which demand it. The 16-bit instructional 
word length is also more efficient in memory addressing capa- 
bility. The memory may be addressed by the fast direct mode 
in sectors of 512 words. This size is ample to accommodate 
the majority of addressing requirements with the fast direct 
mode, 

i _ 

,0 

7. Growth capability . The HDC-601 provides growth 
margin in both memory capacity and computational capability. 

The memory is organized for optimum cost, size, and weight 
into planes or increments of 2048 words each. The controller 
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allowance beyond the current requirements of 7000 words. 

This capacity for growth permits the user to capitalize on 
new functions that may subsequently become needed or desirable. 
If necessary, the controller memory capacity can be expanded 
-tro -a -maximum 'of 32, 768 words. The HDC-601 also has a 30- 
percent growth margin in computational speed capability since 
only 14 msec out of each 20 msec sampling period are utilized 
for computation and built-in test. 

Computer Organization 

Each of the dual redundant computers in the controller 
are functionally divided into processor and memory sections 
as shown in Figure 4.20-15. The processor provides the 
computer's arithmetic, control, and input/output interfacing 
capabilities. Interface with the remainder of the system is 
through the computer interface electronics described in 
paragraph 4.20.4.2. The memory provides storage for instruc- 

tions, computational constants, and data from the vehicle 

and the sensors. Portions of the memory are used as a 

"scratch pad" to store intermediate computations. The memory 

system provides a parity bit for each memory word for use in 
detecting memory system errors. 
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in Table 4.20-12. A more detailed description may be 
found in the Honeywell HDC-601 Digital Computer General 
Description P9-003B (Phase B Supporting Analysis Data, 

Volume 63) . 

Central Processor 

The central processor for the HDC-601 computer employs 
a parallel-organized data flow structure with conventional 
organization relative to memory interfacing and instruction 
execution. Implementation of the logic is accomplished using 
small and medium scale bi-polar transistor-transistor-logic 
(TTL) integrated circuits. These circuits have proven 
reliability backed by substantial field data. 

Organization. In its basic functional organization, 
the central processor can be represented as shown in Figure 
4.20-16. Interfaces to the central processor are: 

1. Memory interface 

2. Direct memory access channel 

3. Direct input/output channel 

4. Computer clock 

5. Interrupt inputs 

6. Input discretes.' 

All communication with the central processor is via these 
interfaces. 
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TABLE 4.20-12 HDC-601 COMPUTER CHARACTERISTICS 
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between the central processor and memory is through the 
memory data register with memory address information supplied 
by the memory address register. From the memory data register, 
data cen be routed through the adder to any other register. 

'The adder serve's berth as a 'transfer gate and as an arithmetic 
element during arithmetic operations. Data and information 
are routed throughout the central processor in accordance 
with the dictates of the particular instruction being executed. 
Data is transferred between the central processor ane the 
system via both the direct input/output channel and the direct 
. memory access channel. 

Control. Execution of instructions is controlled by 

timing and instruction decoding logic within the central 

processor, Each instruction is performed in basic steps called 

microprograms. These microprogram steps include all the basic 

operations necessary for operation of the central processor. 

Timing for central processor operations is obtained from a 

0 

stable 3-MHz clock, which also supplies timing signals to 
other points in the system. 1 The interrupt inputs provide 
control of the central processor by other parts of the system. 
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A plated wire memory is used with each redundant computer 
channel. A functional block diagram of the memory organization 
is shown in Figure 4.20-17. The package consists of four 
printed wiring boards containing sense /digit and word/timing 
electronics, and six boards forming a memory stack. Each 
memory board contains its own word select electronics. The 
two surfaces of each memory board also contain printed wiring 
interconnections for the electronics plus parallel conductors 
(word straps) used for word selection. The 2-mil plated wire 
memory elements are supported in parallel tunnels lying between 
and at right angles to the word straps on the board surfaces. 
All boards are securely fastened and supported by a rigid 
frame. Interconnections are made by flexible flat cable. 


Characteristics of the memory are as follows: 

1. Capacity: 12,288 x 17-bit words. 

2. Cycle Time: 1 microsec (capability to execute 

- any combination of read and write cycles at the 

m 

rate of 1 MHz/ 

3. Access Time; 350 nanosecond 

4. Operating Power: 9 watts average 
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Figure 4.20-17 Plated W ire Memory Block Diagram 

(Typical 1 of 2) 
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42 

controller application over other memory types for the 
following reasons: 

1. Operating speed . The high-speed capability of 2-mil 
plated wire exceeds that required for the controller applica- 
tion and provides higher reliability of operation. 

2. Low power . Nine watts average power is achieved 
through power switching the fast switching characteristics 
of the plated-wire memory element and the nondestructive 
readout characteristic of plated wire. 

3. Minimization of electronics. Two-mil wire can be 
interfaced directly with standard small- and medium-scale 
integrated circuits eliminating the need for high current 
drivers. 

4 Low volume and weight . Optimization of electronics 
and use of multilayer printed circuit boards and medium- 
scale integrated circuits (MSIC’s) minimizes volume and weight. 

' 5. High reliability ." High reliability is derived from 

reliability of plated wire and minimization of electronics. 

6 . Nondestructive readout. (NDRO) . During a read cycle, 
the memory contents are not altered (nondestructive readout) 
precluding the need for a"read restore" cycle. 
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7. Lockout capability . By virtue of the “word 
organized" structure and nondestructive readout operation, 
blocks of memory can be electrically disabled to prevent 
inadvertent alterations of critical instructions and constants, 
Alternatively, the memory can be energized during ground 
maintenance operations and altered via a special GSE con- 
nector. This flexibility is useful for revising the cali- 
bration constants stored in the memory, following a sensor 
replacement. 


8. Temperature stability . No temperature compensation 
is required by the 2-mil plated wire memory over the controller 
operating temperature range. 

9 . Rugged vibration-resistant construction . The 
plated-wire elements, word straps, and associated electronics 
are securely supported by a sandwich structure of memory 
planes and electronics boards mounted in a rigid frame. 

Details relative to the selection of the memory are 
presented in the Honeywell Controller Technology Trade Study, 
970-1327B (Phase B Supporting Analysis Data, Volume 58). 
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The output electronics (Figures 4.20*18 and 4.20*19) 
accept digital control commands from computer interface 
electronics No. 1 converting them to analog voltages for 
control of servovalve actuators, on/off controls, and spark 
igniters. The output electronics are dual redundant. Each 
consist of: 

1. Output switch and command decoder. 

2. On/off controls and igniter drivers to energize 
engine on-off valves and spark igniters. 

3. Servovalve control circuits to energize and 
position proportional servovalve actuators, and 

to operate fail-operational and fail-safe solenoids. 

Both redundant output electronics channels (A and B) 
accept digital data from the controlling computer, converting 
it to on/off and analog commands for the engine controls. 
Channel A energizes the operational torque motors for the 
proportional valves, and channel B the standby torque motors. 
Channels A and B each energize half of the redundant outputs. 
Nonredundant coils on valves are divided between channels A 
and B. All output commands are fed back to the digital 
computer to verify the output electronics operation. In 
addition, the operation of the actuator servovalves is 
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Figure 4.20-19 Output Electronics Organization 
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REP. NO. 


compared to an electronic model. If an unacceptable error 
or failure is detected in one of the dual servovalves, the 
channel is disabled by removing power. If the second servo- 
valve fails, the associated actuator is hydraulically locked 
in its last position to maintain engine operation. 


Output Switch and Command Decoder 

Digital engine commands are presented at the outputs 
of No. 1 and No. 2 computer interface .electronics in 16-bit 
parallel format. The output switch and command decoder, 
Figure 4.20-20, is controlled by computer No. 1 watchdog 
timer. The watchdog timer output logical one enables 18 
AND gates to transfer 16 bits of direct output data from 
computer interface electronics No. 1 into a storage register. 
The 17th and 18th bits control enable signals from the 
computer direct input /output address bus to the storage 
register and the command decoder. 


If the watchdog timer output switches to zero signify- 
ing a failure in computer No. 1, the first set of AND gates 
will be disabled and a second set enabled transferring the 
output of computer No. 2 to the storage register. 
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REF. While the digital data is in the storage register, it 

42 

is fed back to the digital computer built-in-test inputs 
for verification. Lack of verification will initiate a new 
command from the computer. Repeated nonverification (3 times) 
is a failure. 

When the data in the storage register is verified, 

12 bits are available to the on/off controls and igniter 
drivers and to the servovalve control circuits. The remain- 
ing 4 bits are decoded in the command decoder and used to 
control the sequencing, routing, and timing of the output 
signals. 

When the controller has verified commands for the 
igniters and on/off controls in the output switch storage 
register, all 12 bits are clocked by a second enable signal 
and routed by the command decoder into the register for the 
on/off controls and igniter drivers, Figure 4.20-21. The 
appropriate "on" or "off" inputs are then enabled to the 
12 drivers to set the controls for the command. Under 
software control the register maintains the initially 
commanded output to each driver until a change is commanded, 
i.e., to reduce solenoid power to the hold-in level or to 
energize or de-energize a specific solenoid. The driver 
outputs are checked periodically by built-in-test . 
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F igure 4.20-21 On-Off Controls and Igniters and Drivers 

(Typical 1 of 2) 
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Actuator Servovalve Operation 




Each proportional valve actuator is driven by two 
servovalves. One is normally in control and is energized 
by output electronics .Channel A. 

The second is energized by Channel B., but is in standby. 
Actuator control is transferred to the standby servovalve 
when either servovalve fail-operational solenoid is energized. 
When both fail-safe solenoids are de-energized, the actuator 
is hydraulically locked in its last position. 


Servovalve Control Circuits 

Verified proportional valve commands in 12-bit digital 
format are transferred by the command decoder from the output 
switch storage register to the servovalve command register. 
Figure 4.20-22., Once every 20 msec the command for each 
proportional valve is converted to an analog voltage by the 
digital-to-analog converter and clocked into one of the five 
sample and hold circuits. Multiplexing these signals one 
at a time eliminates the need for four additional sets of 
storage registers and digital-to-analog converters. 

The sample and hold analog voltage proportional to the 
commanded valve position is summed in the driver input 
circuit with the demodulated actuator position feedback 
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Figure 4.20-22 Servovalve Control Circuit 

(Typical 1 of 2) 
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The resulting error signal drives the servovalve torque motor 
until the actuator reaches its commanded position and the 
error signal is a null. 
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The analog command from each sample and hold circuit 
is also summed with the demodulated actuator position feedback 
signal in a servo valve model and comparator circuit. The 
resultant error signal is the same as that seen by the servo- 
valve and is applied to an electronic model of the servovalve. 
The electronic model output is dynamically compared with 
demodulated LVDT feedback signal representing the servovalve 
second stage spool position. When either electronic model 
(Channel A or B) indicates a servovalve is not following its 
command signal, a fail indicate signal is generated in the 
logic unit. The logic unit then energizes or de-energizes 
the servoactuator fail-operational or fail-safe coils per 
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The power supply electronics (Figure 4.20-23) rectify, 
filter, and regulate 115 volt, 3-phase, 400 Hz for use in the 
engine controls. Dual redundant power supply electronics 
energized from redundant vehicle power buses maintain the 
•required ‘'fail-operational , fail-safe capability. Redundancy 
in the regulators matches that of the electronics functional 
subsystems. Protection is provided against propagation of 
overload failures. The power supply electronics include 
provisions for detecting and reacting to out of tolerance 
voltage, power failure and power recovery. 

Power Supply Redundancy 

Each of the two redundant power supplies consists of 
line filter transformer with multiple secondary windings 
and associated rectifiers, and a family of voltage regulators. 
As shown in Figure 4.20-24, each l£>ad branch is^supplied 
from the redundant vehicle power buses through separate 
regulators. Uninterrupted power will be maintained to each 
load in the event of a failure in a power bus, rectifier 
or regulator A minimum of two regulator failures to the 
same load are necessary to shut down a computational 
channel. 
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Figure 4.20-23 Power Supply Electronics 
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The redundancy if protected from propagation of overload 
failure by foldback limiting incorporated in each regulator. 

If load current exceeds an acceptable level, the foldback 
limiter will isolate the load until the overload is removed. 
This feature protects the primary supplies and the remaining 
functions dependent upon them. 




< 


Power supply and regulator redundancy is shown in greater 
detail in Figure 4.20-25. The two sets of power supply elec- 
tronics, No. 1 and No. 2, are dedicated to the corresponding 
computers and computer interface electronics. In addition, 
each of the three input electronics data channels and the two 
output electronics data channels are supplied from separate 
regulators to preserve their redundancy. This also provides 
a selective turn off capability if an out-of-tolerance condi- 
tion arises. 

Power Supply Electronics Design 

Each set of power supply electronics. Figure 4.20-25, 
incorporates radio frequency interference filtering (not 
shown), multiple transformer secondaries,, and 3-phase, full- 
wave rectifiers with combination passive and active filter- 
ing. Redundant 28-volt regulators in each of the two power 
supplies independently supply power to both digital computers. 
The 28 volt regulators also supply power to the random 5 volt 


u. 
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42 regulators for the Input electronics, eliminating an addition- 
al regulator in each supply. The digital computer power is 
obtained from a dc to dc converter to provide isolation and 
to preserve the existing circuit and logic design of the 
HDC-601 computer. 

Redundant regulators provide +15 volts, +5 volts, and 
-20 volts for the input and output electronics. Separate 
+28 volt regulators supply the solenoid valves. The power 
supply electronics for each input and output electronics 
channel includes a precision dc reference source for the 
analog-to-digital and digital-to-analog converters, and the 
temperature and pressure sensors. Also included is a precision 
ac reference source for the linear variable differential 
transformers. The power supplies use both series and switch- 
ing type regulators. The choice is dictated primarily by 
efficiency considerations, with the aim of minimizing internal 
power supply dissipation. The 28 volt regulators with their 
high and variable current loads and the high-current, 5 volt 
regulators are of the switching type with noise suppression. 

Each power supply branch includes provisions to monitor 
the voltage levels and to shut down the branch if high out- 
of-tolerance voltages are experienced. Power shut down 
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42 capability is also controlled by the watchdog timers and by 
the digital computers. 


Simultaneous loss of power on both input power buses 
for more than a few milliseconds will force the controller 
'into 'an ‘iiraobive ^standby 'condition. If power is restored on 
one of the buses within 50 msec, normal operation will resume. 
If not, a safe engine shutdown will be initiated. 

The power supply electronics for the digiral computer 
include a power failure and recovery interrupt circuit. 

Figure 4.20-26. This circuit initiates a computer interrupt 
to store all critical computation parameters before shutdown, 
enabling a successful reinitiation of the computer program 
upon power recovery. The interrupt is initiated by over 
voltage, under voltage, or loss of power either due to power 
bus failure or to an intentional shutdown by the watchdog 
timer. 

As shown in Figure 4.20-27, the .energy stored in the 
power supplies will sustain computer operation for a minimum 
of 125 microsec after power interruption. This is more than 
adequate time for the computer to perform an orderly and safe 
shutdown. When power recovery occurs and the supply voltages 
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Figure 4.20-26 Processor Power Failure Detection 
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42 stabilize, the power recovery circuit generates an interrupt 


to resume normal computer operation. 

Power Requirements 

The total electrical power required by the engine is a 
■maximum "of 560 'watts ‘during "Steady 'State conditions and 870 
watts for 3.5 seconds during engine start. Of the 560 watts 
total required during steady state conditions, 443 watts are 
dissipated in the controller and 117 watts are dissipated in 
valves and sensors. 
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42 4.20.5 CONTROLLER SOFTWARE 

The selected avionics approach incorporates two general- 
purpose Honeywell HDC-601 digital computers packaged within 
each of the three main engine controllers. The computers 
can be fully reprogrammed to solve any computational problem 
within the hardware limitations of word length, processing 
speed, and memory capacity. Each computer has its own program 
stored within its 2-mil plated-wire computer memory. The 
programs may easily be changed by using a portable memory 
loader. The memory loader interfaces with the controller 
through ground support equipment electrical connectors on 
' the controller. The memory loader obtains the program infor- 
mation from a punched tape, which it encodes into electronic 
information to be stored in the computer memories. The memory 
loader also checks the computer program against the punched 
tape after it is read into the computer memory to ensure that 
no errors have been introduced into the program. 

The capability of easily changing the programs stored 
in the controller computer memories provides a flexibility 
to accommodate normal development changes quickly, safely, 
and at low cost. The approach to developing the flight 
program for the controller is to create one main program, 
called the executive program, and several special purpose 
subprograms. 
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The individual subprograms perform special numerical 
computations on data or make logical decisions (e.g., igniter 
checkout, start preparation, or start). The executive program 
has the primary task of supervising the sequence of processing 
subprograms when needed and for keeping track of the total 
status of the engine, avionics and commands from the vehicle. 

The HDC-601 has a fully developed standard software 
programming library consisting of: 

1. DAP-16 Assembler 

2. FORTRAN IV Compiler 

3. Standard Input /Output Library 

4. Mathematical Library 

5. Utility Routines 

4.20.5.1 CONTROLLER EXECUTIVE PROGRAM 

The executive program establishes the sequence of oper- 
ations to be performed by the digital computer. Operation 
of the executive program is cyclic. A complete cycle (one 
pass through the executive program) is completed every 20 
milliseconds. Figure 4.20-28 is a simplified flow chart of 
the executive program. Under normal operation, whether on 
the ground for checkout or during flight, the computer pro- 
gresses through the executive program, performing the indicated 
operations in an endless loop. The loop is broken and the 
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Figure 4.20-28 Major Cycle Executive Program 
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42 sequence of operations is revised by any one of several 
possible events: 

1. Command received from vehicle alters control or 
checkout phase of operation. 

2. Built-in test determines component failure. 

3. Engine limit detection monitor determines engine 
exceeded allowable limits. 

The executive program contains the logic to evaluate all of 
the three events listed, update the engine status byte and 
phase table stored in computer memory, and change the sub- 
programs to.be processed by the computer. 

As indicated in Figure 4,20-28, by the five terminal 
points, the executive program may be entered from several 
points with different external conditions. The start of the 
executive program cycle during ground operation begins with 
application of power to the controller which resets and 
initializes the computer. This inhibits controller outputs 
during the transition to full electrical power and forces - 
the executive program to start from a predetermined memory 

i 

location. The engine status byte and phase tables are set 
to the initiation condition. A controller self-test is pro- 
cessed each cycle. Successful completion of the controller 
self~test is required prior to performing a subprogram of 
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42 engine operation. The logical decision"engine phase in 

process*' is processed by the executive program to determine 
which subprogram, listed in Table 4.20-13, is to be processed. 
A failure detected during controller self-test or engine phase 
subprogram processing is evaluated and corrective action taken 
as indicated. Exceeding an engine limit condition will result 
in an engine shutdown only if the vehicle will permit a shut- 
down. The engine status byte and phase tables are updated 
each cycle to indicate current engine status and engine 
sequencing phase. 

One watchdog timer is reset each time through the 
executive program cycle. Sensor data which does not require 
executive program control to be processed into memory are 
validated, redundancy verified, and parameter values averaged 
in the block "process sensor data". Maintenance data for 
vehicle recording is processed intthe block process data for 
vehicle. This completes the major executive cycle in less 
than 20 msec. The executive program then waits for the 
computer real time counter to signal a time interrupt to 
repeat the cy&le . — ----- -- ------ — - 

The executive program cycle may be interrupted in any 
part of the repetitive cycle by interrupts generated by built- 
in test within the controller or by vehicle command interrupts. 
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TABLE 4.20-13 SUBPROGRAM 



SUBPROGRAMS 


1. AUTOMATIC CHECKOUT 

A. MEMORY SUM CHECK 

B. PRESSURE SENSORS CALIBRATION CHECK 

C. ^ TEMPERATURE SENSOR FUNCTIONAL CHECK 

D. FLOW /SPEED SENSOR FUNCTIONAL CHECK 

E. VIBRATION SENSOR' FUNCTIONAL CHECK 

F. -SPARK IGNITER FUNCTIONAL CHECK 

G. ACTUATOR /VALVE FUNCTIONAL CHECK 

H. PNEUMATIC SHUTDOWN TEST 

I. EMERGENCY BOOST MODE LIMIT SHUTDOWN 

CONTROL FUNCTIONAL CHECK 

J. EXTENDABLE NOZZLE FUNCTIONAL CHECK 

2. START PREPARATION 

A. GN 2 PURGE 

B. INTERMEDIATE SEAL PURGE 

C. HELIUM FUEL SYSTEM PURGE 

D. PROPELLANT RECIRCULATION 

E. HELIUM FUEL SYSTEM PURGE: PROPELLANTS 

DROPPED 

3. FLIGHT 

A. START 

B. MAIN STAGE 

C. SHUTDOWN 

4. POST-SHUTDOWN 

A. PROPELLANT DUMP 

(1) LIQUID OXYGEN DUMP 

(2) FUEL DUMP 

B. ABORT TURNAROUND BOOSTER 

(1) HELIUM FUEL SYSTEM PURGE 

(2) PROPELLANT RECIRCULATION 
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42 Memory parity, watchdog timers, actuator redundancy 

failure, and loss of electrical power initiate interrupts by 
hardware built-in test within the controller. A loss of 
power results in a power interrupt which causes computational 
operation to stop for the duration of the failure. If power 
is restored, a power recovery interrupt is generated which 
starts the executive program at the “initiate major cycle” 
block. This is different from normal power startup because 
the computer memory still retains all data processed prior 
to the interrupt, including engine status byte and phase 
tables. Thus, if the power failure is not too long (less 
than 50 milliseconds), normal control may be resumed. 

Parity error or watchdog timer failure are failures of 
a controller channel and cause control to switch to the 
redundant operational channel. They generate interrupts, 
which turn off both watchdog timers for the failed channel, 
command the failed computer channel to HALT processing, and 
turn off power to the failed computer'. Power can be restored 

to the failed channel only by cycling the reset. Nornally, 

this is not done until the flight is ended and the controller 
is being checked out. 
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vehicle at any time and interrupt the executive program for 
processing, as illustrated in Figure 4.20-29. The executive 
program resumes control upon completion of the processing 
and implements the command or request for data. 

The six engine mission phases are; (1) checkout, 

(2) start preparation, (3) start, (4) mainstage, (5) shutdown, 
and (6) post-shutdown. Subprograms common to engine phases 
are not duplicated for each phase, which conserves memory. 

The executive program determines entry and exit points for 
linking programs together. The subprograms are expanded and 
- described in detail in later sections. For the three flight 
phases (start, mainstage and shutdown), all computations in 
the subprograms assocaited with each phase are accomplished 
each major cycle. The remaining phases each require multiple 
cycles to complete the required operations. For example, the 
automatic checkout subprogram may command an actuator to move. 
It will verify the motion on later major cycles, giving time 
for the actuator to respond. 

Inputting sensor data into memory is not a function of 
the executive program, but is under control of the direct 
memory access. This requires no processor time; however, 
the direct-memory access sequence may be altered by the 
executive program. 
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Figure 4.20-29 Vehicle Command Interrupt 
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42 4.20 

.5.2 CONTROLLER SELF-TEST 



The controller self-test program (Figure 4.20-30) is 
executed during each cycle through the executive program. 

It verifies the status of all controller components except 
for some of the low-level multiplexer switches, vibration 
sensor input amplifiers, and position sensor input demodu- 
lators. Those components are checked as part of the sensor 
input tests. 

The individual controller subsections are tested in 
sequential fashion, as shown in Figure 4.20-30. If a compo- 
nent failure which does not impair the operability of the 
controller is detected, the failure is indicated to the 
executive and the program returns to the next step normally 
performed in the test sequence.' If a failure occurs which 
results in an inoperative controller channel, the controller 
self-test program indicates the failure to the executive 
and transfers control to the executive for the processing 
of channel shutdown, indicated in Figure 4.20-28. 

4.20.5.3 AUTOMATIC GROUND CHECKOUT 

Upon receiving a checkout command via the vehicle data 
bus, the executive program selects the automatic ground 
checkout mode. Since the controller self-test has been per- 
formed as a part of each pass through the executive program. 







398-8 


date 10 / 20/72 


THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 


page no. 4-487 





< 































DATE 10/20/72 

THE SINGER COMPANY 
SIMULATION PRODUCTS DIVISION 

PAGE 

NO. 

4-488 

REV. 

BINGHAMTON . NEW YORK 

REP. 

NO. 



ref. 

42 the components remaining to be checked include actuators, 
valves, spark igniters, sensors, and certain sensor inter- 
face circuits which cannot be completely checked by the 
controller self-test. An additional memory sum test of the 
computer memory is also performed as further assurance that 
the program is valid and that all memory locations can be 
addressed. 

The automatic checkout begins with the memory sum test, 
as shown in Figure 4.20-31, and continues with a checkout of 
pressure and temperature sensors. A check is made to ensure 
that no propellants have been dropped before any further 
checkout is performed. Tests of the remaining components 
noted above are then made. This includes a verification of 
all redundancy and fail-safe backup provisions. 

Any failure detected in the checkout sequence is iden- 

^5t. 

tified to the executive. If the failure does not prohibit 
further checkout, the program returns to the checkout sequence 
and completes the tests. Status upon completion of the check- 
out is indicated to the executive, which in turn processes 
it for transmittal to the vehicle when requested. 
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42 Subprograms which provide a checkout of individual 

components or types of components are contained in the com- 
puter memory. The propellant and pneumatic valves and 
extendible nozzle may be individually checked out. The 
sensors are checked out as a group. The spark igniters are 
also checked out as a group. The flow charts for these 
component tests are presented in Figures 4.20-32, 4.20-33 
and 4.20-34. 

The propellant valve, extendible nozzle, and spark 
igniter test programs contain interlocks to verify that 
propellants have not been admitted to the engine. Since 
the executive program verifies the engine's operating mode 
before calling on a subprogram, no additional interlocks are 
required for the sensor tests. • 

4.20.5.4 START PREPARATION 

The start preparation phase of engine operation may 
be entered and sequenced by commands from the vehicle follow- 
ing successful completion of an engine checkout. Four purges 
are required to condition the engine for start. These include J 
1. GN^.rpurge until engine start and helium purge of 
high-pressure oxidizer turbopump intermediate seal 
for approximately 10 minutes prior to dropping 
propellants. 
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REF. 2. Helium purge of the fuel system for approximately 

42 

3 minutes prior to dropping propellants. 

3. Propellant recirculation when propellants are 
dropped, and 

4. Helium purge of the 'fuel system repeated for 
approximately 3 minutes prior to engine start. 

The time allocated for each purge is controlled by the 
vehicle. Interlocks in the executive program phase table 
verify that the sequence is correct and that conditions are 
acceptable prior to initiating the first purge. 

A flow chart of the start preparation phase is shown 
in Figure 4.20-35/ Each subprogram is designed to be 
executed for each major cycle. 

The first subprograms performed by command from the 
vehicle '"are the nitrogen purge and high-pressure oxidizer 
turbopump intermediate seal purge. Commands to energize 
the nitrogen and high-pressure oxidizer turbopump inter- 
mediate seal solenoids are issued the first time through 
the subprogram. Correct output command signals and pressure 
sensor measurements are verified each major cycle of the 
esecutive program forthe duration of the subprogram. Status 
is indicated to the executive for evaluation. 
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The helium fuel system purge control command from the 
vehicle sequences the helium fuel system purge subprogram. 

A command is issued the first time through the subprogram 
to energize the helium fuel system purge solenoid. Outputs 
to the solenoids and GK^ purge pressure, helium fuel system 
purge pressure, and intermediate seal purge pressure are 
verified each major cycle for the remainder of the subprogram. 

When propellants are admitted to the engind, the vehicle 
issues a propellant recirculation command. This command 
terminates the helium fuel system purge and high-pressure 
oxidizer turbopump intermediate seal purge subprograms and 
initiates the propellant recirculation subprogram. Commands 
are issued to de-energize the helium fuel system and inter- 
mediate seal purge solenoids. The GN2 system solenoid remains 
energized. Additionally, the first time through the subprogram, 
commands are issued to energize liftoff seals and open bleed 
valves. Subsequently, GN2 purge pressure, liftoff seal 
pressures, fuel and oxidizer bleed valve positions as well as 
controller output are verified each major cycle for the 
duration of the subprogram. 

The last subprogram of the start preparation is again 
a helium fuel system purge control commanded by the vehicle 
and is an addition to . the previous subprogram. A command is 
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42 * issued the first major cycle to energize the helium fuel 
system purge solenoid. Outputs to solenoids, GN 2 purge 
pressure, liftoff seal pressures, helium fuel system purge 
pressure, and bleed valve positions are verified each major 
cycle for the duration of the subprogram. 

In addition, the propellant pressures and temperatures, 
and propellant valve positions are measured and verified each 
major cycle. The engine status byte is updated to "engine 
ready" 3 minutes after the start of this subprogram if 
propellant conditions are acceptable for starting the engine. 
The normal exit from this subprogram is by receiving a start 
command from the vehicle. Commands are issued to de-energize 
the GN 2 purge solenoid, the helium fuel system purge solenoid, 
the liftoff seal solenoids which also close the bleed valves, 
and energize the intermediate seal purge solenoid. At least 
one additional major cycle is required to verify that the 
intermediate seal purge pressure is within limits prior to 
completing the start preparation phase. 

4.20.5.5 FLIGHT PROGRAMS , 

Repeatable start, mainstage, and shutdown control are 
implemented with open-loop sequencing of valves, switching 
to closed-loop thrust control from a thrust level of approxi- 
mately 10 percent to EPL. Closed-loop mixture ratio control 
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42 is implemented 3.5 seconds after start initiation until shut 
down. The flexibility of the digital controller allows modi 
fication to the sequence of closed-loop logic with simple 
software program changes. 

Start Control 

The executive program initiates the start control sub- 
program upon receipt of the start command from the vehicle. 
Three interlocks are provided to ensure proper initiation of 
start. The engine must be in an "engine ready" status and 
have received thrust level and mixture ratio command values 


from the vehicle. The start control, shown in Figure 4.20-36, 
contains a start sequence timer (software program) to control 
which program branch is followed until time for the next event. 
The branches correspond to the phases of start control described 
previously in Section under Engine Start. Actuator 

commands^are computed in the appropriate start control branch, 
outputted and verified each major cycle. The start sequence 
timer switches phases as each is completed. Ignition is 
confirmed at 1 second by verifying that a thrust level of 5 
to 15 percent has been achieved. All propellant valves are 
closed immediately if ignition is not confirmed. The thrust 
control loop is closed for mainstage control at 1.7 seconds 
and the thrust is ramped to the commanded level. The loop j 
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is closed on mixture ratio control at 3.5 seconds and ramped 
to the commanded value. Engine limit parameters are monitored 
each major executive program cycle to ensure safe engine 
operation throughout the start control. The executive will 
initiate a shutdown at any time during the start control if 
an engine limit is exceeded and limit control is enabled by 
the vehicle or a shutdown command is received from the vehicle. 

Mainstage Control 

The transition from start to mainstage control is smooth. 
Closed-loop thrust control is initiated in the start control 
mode at a 10 percent thrust level. Closed-loop mixture ratio 
control is initiated at the mixture ratio level present 3.5 
seconds after start and ramped to the commanded value. 

Mainstage control consists of computing and outputting thrust 
and mixture ratio commands from computed mixture ratio thrust, 
fuel preburner temperature margin, and oxidizer preburner 
temperature margin, as illustrated in Figure 4.20-37. Pre- 
burner temperature control is only applicable if limit control 
is enabled by the vehicle. Thrust error is used exclusively 
to compute the oxidizer preburner oxidizer valve command if 
limit control is inhibited. The thrust and mixture ratio com- 
mands from the vehicle are processed immediately. A shutdown 
willube initiated during mainstage control by either an 
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Figure 4.20-37 Mainstage Control 
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shutdown command from the vehicle. 


Shutdown Control 

Normal shutdown control is accomplished by closed-loop 
control thrust decrease followed by a sequencing of propellant 
valves closed, as shown in Figure 4.20-38. The closed-loop 
phase uses the same closed-loop thrust and mixture ratio 
control subprograms as mains tage control. Normal shutdown 
control is accomplished upon command from the vehicle or by 
the executive if an engine limit is exceeded and limit control 
is enabled. ’ The internal thrust reference level determines 
the entry point of the shutdown phase. Thrust level above 
MPL initiates a controlled decrease rate of 4800 pounds 
(21.351 newtons) per 10-msec interval to MPL. Below MPL, 
a software timer is used to control the sequencing of propel- 
lant valves closed. The times indicated in Figure 4.20-38 
correspond to when that branch is initiated and followed 
until the next branch is applicable. Valve positions are 
monitored each cycle throughout the shutdown subprogram. 

The executive program automatically initiates retraction of 
the extendible nozzle 4 seconds after orbiter shutdown. 
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Figure 4.20-38 Shutdown Control 
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Post-Shutdown 

The post-shutdown phase is entered by the executive 
with the completion of the nozzle retraction. No subprograms 
are active during this time; only the controller self-test 
is performed each major cycle. Power may be safely removed 
from the engine at this time. Two other options are also 
available. Propellant dumping through the engine for either 
the booster or orbiter or an abort turnaround may be commanded 
for the booster if the preceding shutdown was not due to an 
engine malfunction. 


Propellant 1 Dumping 

The executive enters the propellant dump mode of the 
post-shutdown phase by command from the vehicle. Interlocks 
are provided by the executive to prohibit opening both fuel 
and oxidizer valves at the same time. The duration of the 
mode is controlled by the vehicle. Figure 4.20-39 is a 
flow chart for the subprogram. Liftoff seals are verified 
open and bleed Valves closed following the propellant dump 
mode command from the vehicle. Individual valve commands 
from the vehicle are outputted, to the actuators during the 
appropriate major cycle. An interlock is included to ensure 
a helium fuel system purge is active for a minimum of 10 
seconds following an oxygen dump and prior to a fuel dump. 
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42 Following the closing of the main fuel valve, the 

sequence is complete. 


Abort Turnaround 

The executive may be commanded to enter an abort turn- 
around .mode of .the post -shutdown phase by command from the 
vehicle. This applies to a booster only if the abort was not 
due to an engine system malfunction. The sequencing of the 
mode is controlled by the vehicle, resulting in an engine-ready 
condition approximately 5 minutes following the shutdown, A 
flow chart of the subprogram is shown in Figure 4.20-40 and 
is similar to subprograms of the start preparation phase. 

Each subprogram is designed to be executed each major cycle. 

The first subprogram performed by command from the 
vehicle is the helium fuel system purge. Commands to energize 
the helium fuel system intermediate seal, and GN£ solenoids 
are issued the first time through the subprogram. Correct 
output signals and pressure sensor measurements are verified 
each major cycle for the duration of the subprogram, and any 
failure detected will be indicated to the executive for ; 

evaluation. 

The propellant recirculation command from the vehicle 
sequences to the propellant recirculation subprogram, which 
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42 is an addition to the previous one, and a command is issued 
to energize the liftoff seals and open the bleed valves. 

Liftoff seal pressure measurements and bleed valve positions 
are verified each major cycle of the subprogram. In addition, 
propellant conditions and propellant valve positions are 
verified each major cycle. Engine status is updated to engine- 
ready 3 minutes after propellant recirculation commences if 
propellant conditions are satisfactory for engine start. 

The mode is exited when a start command is received 
from the vehicle. Solenoids for the helium fuel system, GN 2 

1 

purge, and propellant recirculation are de-energized. Outputs, 
intermediate seal pressure, and hydraulic pressure are veri- 
fied prior to transferring to the start phase. 

Power Off 

A reset command is required from the vehicle prior to 
removing engine power. The purpose of the reset is for the 
executive to differentiate removal of power and a power 

1 

transient. The phase table and status byte are cleared by the 
executive with a reset command. Following a power recovery, 
the executive examines the phase table and determines the 
correct engine operating phase to return to. 
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42 4.20.5.6 SENSOR DATA 

Reading of sensor data into memory is sequenced and 
controlled by direct memory access on a cycle-stealing basis 
from the processor. Each direct memory access cycle interrupts 
processing for one memory cycle time (1 microsecond) to 
directly insert or 'extract data 'to'/from -memory without dis- 
turbing computations. Sensor values are computed from raw 
data and calibration constants stored in memory. Temperature 
equations are second order and pressure equations first order. 
After the sensor equations have been calculated, the sensor 
values are voted and averaged to determine a parameter value 
. which is used in the computational equations and engine limit 
detection. Figure 4.20-41 is a flow chart illustrating sensor 
voting and averaging. Each sensor is individually tested 
and the differences computed. If the differences are within 
limits, the average value is stored as the parameter value. 

The subprogram is repeated each major cycle for each parameter 
except sensors which are for flight maintenance recordings 

1 

only. 
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42 4.20.5.7 ENGINE LIMIT DETECTION 


The engine limit flow chart is shown in Figure 4.20-42. 
Each sensor is tested for range, and if either sensor indicates 
safe operation, no failure is indicated. 


'4 .'20 .5 .-8 ‘COMPUTER SPEED AND MEMORY SIZE CAPABILITY 

The controller software requirements are within its 
computer speed and memory size capabilities, with spare speed 
and capacity for further software growth. 

The required computer speed is dictated by the amount of 
processing to be performed in the main computational loop, 
which has an iteration rate of 50 samples per second. The 
speed requirements for the other executive functions is a slow 
rate in comparison to the main loop requirements and does not 
affect the iteration cycle time requirement? The tabulation 

of the requirement is shown in Table 4.20-14. This requirement 

" " ; 

REF. is currently being expanded to 16K of memory. 

Min. 

Meet. 

§ince there are 20 msec in each 50 sample per second 
iteration available for computation, the HDC-601 performs 
the loop computations 6 msec faster than required, leaving 
a spare duty cycle capacity of 30 percent for future software 
growth. 
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TABLE 4.20-14 COMPUTER MEMORY AND 

SPEED ESTIMATES 


FUNCTIONS 

MEMORY SUE 
{17 BIT WORD) 

CONTROLLER BUILT-IN- 
TEST 

>300 .. 

SENSOR BUILT-IN-TEST 

1 LOO 

' ACTUATOR/VALVE BUIIT- 
, IHrTEST 

.200 

OATA TRANSMISSION 

200. 

EXECUTIVE PROGRAM 

1000 

AUTOMATIC CHECKOUT 
SUBPROGRAM 

500 

START PREPARATION 
SUBPROGRAM 

300 

FLIGHT SUBPROGRAM 

START _ 

mainstase 

SKUTDOVO* 

300 
1200 
3 oo 

POST-SHUTDOWN 

SUBPROGRAM 

■300- 

'SUBTOTAL 

7000 

GROWTH 

5000 

TOTAL 

12000 
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42 

Computer Memory Size 



Computer memory size is dictated by the capacity required 
for all programs executed by the controller. The tabulation 
of this is shown in Table 4.20-14. This tabulation shows that 
there is a 41 percent spare memory capacity for future software 
growth. 

4.20.5.9 HOC -601 PROGRAMMING FEATURES 

The cost and time for development(during Phase CD) of 
the controller control and checkout program is reduced by the 
off-the-shelf availability of the complete, thoroughly 
debugged HDC-601 library. Control of the main program and 
subprograms is optimized for minimum processor time and soft- 
ware by : 

1. Timely processing of vehicle commands using the 
HDC-601 priority interrupt function. 

2. Initiation of main program loop at 20 msec intervals 
under a lower priority computer clock-driven interrupt. 

3. Initiation of lower frequency data transmission 

sorting loops by lower priority computer clock- j 

driven interrupts. 

4. Direct memory access of sensor data independent 
of central processor operation. 

The two standard software systems available for use in program- 
ming, debugging and maintenance of the controller processor 
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42 and associated memory are (1) DDP-516 standard software and 
(2) HDC-601 diagnostic programs. 


DDP-516 Standard Software 

A comprehensive package of DDP-516 programs is available 
for use with the HDC-601 and controller as part of the Honeywell 
standard product line software. These programs, designed for 
a wide range of user skills and applications, include the most 
widely used programming practices and conventions. The soft- 
ware package includes the following items: DAP-16 Assembly 

Program, FORTRAN IV Compiler, Utility Routines, Input /Output 
Routines, and Mathematical Subroutines. For example, the 
DAP-16 program is used off line in the DDP-516 to convert the 
controller instructions from the initial assembly language to 
machine language. Another; program simulates all controller 
programs on a computer with FORTRAN IV capabilities. 

HDC-601 Diagnostic Programs 

In addition to the DDP-516 programs, an extensive 
package of diagnostic programs for use* with repair depot 
level is available with the HDC-601. These programs are 

l 

designed to verify the operation of the processor and memory, | 

i 

and in the case of a faulty operation, to detect and isolate 
faults to the replaceable subassembly level. The diagnostic 
package consists of a. computer self-test, a processor module 
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42 test, and a plated wire module test. The diagnostic tests 


are performed in conjunction with three pieces of support 
equipment, the Computer Control Unit (CCU) , the ASR-35 Teletype 
Unit, and a high-speed paper tape reader. 

-Computer Self -Test 

The purpose of this program is to determine whether the 
processor and memory of the computer are functioning properly 
and indicate failed subsystems. It is the same as used in 
flight controller self-tests. 

Processor Module Test 

The purpose of the processor module test is to check 
all of the functions of the processor and the Computer Control 
Unit and to isolate functional failures to the board level. 

The processor module test is a semiautomatic procedure 
composed of a manual portion and an automatic portion. The 
manual portion is used to check the hard-core of the processor, 
to check any instructions which require operator intervention, 
and to initiate the automatic portion. The instructions 
checked in this manual fashion are those associated with the 
hard-core (PAS, SKP, and HLT) , the switch testing instructions 
(SR 1, 2, 3 and 4, SSR and SSS) , and the interrupt-associated 
instructions (ENB and INH) . Instruction repertoire and 
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42 definitions are included in Volume 62, Honeywell Report, 
"Honeywell HDC-601 Digital Computer Programmers Reference 
Manual". 

In addition to the above instructions, the functions 
of the PPI/PPH switch and power failure /power recovery circuitry 
are checked in the manual portion of the processor test. 

The automatic portion tests the remaining instructions 
of the processor. Checkout of the indexing, indirect address- 
ing, and extended addressing function of the processor is 
included in .the automatic portion. 

The basic approach of the test program is to use the 
"successive tests" technique.. This technique requires that 
the individual checks of processor functions be organized 
in a building-block fashion starting with the hard-core and 
building^toward the more complex functions. Such ah approach 
yields an automatic functional isolation of processor failures. 
Whenever a functional fault is encountered, . the program will 
output a message to the ASR Teleprinter informing the operator 
which board has failed. . - ' 
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42 

The purpose of the plated wire module test program is 
to detect functional faults within a, plated wire memory and 
to isolate these faults to the replaceable subassembly. This 
program is designed for use with the processor and the plated 
wire memory. “The program ’test's 'the Functions of 'the memory, 
i.e, addressing, writing, and reading. The plated wire 
modules test is designed to exercise the memory in two parts. 

The test is contained on two tapes, one of which checks the 
lower portion of memory, the other checks the remainder. 

The test is designed to detect errors through the use 

of the following checks: (1) addressing test, (2) data 

complement, and (3) disturb test. The addressing test is 

designed to ensure all the address electronics are functioning 

properly and are addressing the proper memory locations. The 

memory address is decoded by the X and Y decoder to select 

the proper word strap, and by the bank selection logic to 

select one of eight banks. The data complement is designed 

* 

to demonstrate the ability of the memory to accept and retain | 
alternate "ones" along any pla.ted wire. The disturb test 
exercises the memory by alternately reading and writing. 

The test also attempts to disturb the data stored in one bit 
location by writing data of the opposite polarity on either 
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42 side of this location along the plated wire. 

Through use of the teleprinter a hard copy of the 
test results is made available to the operator. In the case 
of a fault in the memory, the printout will indicate the 
faulty subassembly. 
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4.?1 Thermal Protection System (TPS) 

The orbiter thermal protection and control system consists 
of two elements. One, the thermal protection system (TPS), is external 
to the structural shell of the vehicle. It maintains the airframe 
outer skin within acceptable temperature limits during the vehicle 
mission. Where internal vehicle special compartments require additional 
thermal control, the external TPS is augmented by a second element; the 
internal thermal control system (TCS). The vehicle thermal system 
also includes the ECLSS, the purge and vent subsystem, and other subsystems. 
See Figure 4. 21 - 1 . 

The baseline TPS consists of: (1) ceramic reusable surface 
insulation (CRSI) (ceramic panels with an external waterproof coating 
on a strain-isolation foam pad) directly bonded to the airframe in 
areas exposed to surface temperature between 650°F and 2500°F; (2) 
elastomeric reusable surface insulation (ERSI) directly bonded to the 
airframe in areas exposed to temperatures below 650°F, and (3) reinforced 
carbon-carbon (RCC) material in the wing leading edge and body nose 
cap in areas exposed to temperatures above 2500°F. 

4.2 7 1 w lCeramic RSI 

The ceramic insulation material basically consists of mullite 
and silica. ; 

e Mullite panels - A low- density insulative composite material 
formed by coating a matrix of mullite fibers rigidized with 
an aluminum-boria silica refractory glass binder. The panel 
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and pad dimensions are determined by the thermal/structural 
analyses. 

• PD- 200 pad - A chemically foamed methyl phenyl silicone elastr- 
meric material. This pad provides strain isolation of the 
CRSI from the aluminum structure and accommodates local 
surface irregularities. Its outer surface design temperature 
is 650°F, determined by the allowable bond temperature. The 
inner surface design temperature is 350°F. This temperature 
was selected to yield the lowest TPS and aluminum primary 
structural weight. Analyses indicate that the bottom and 
chine pad thickness ablative characteristics provide a ceramic 
panel loss fail safe entry. 

e SR-2 coating - A waterproof ceramic coating fired at 2500° F 
on the top and sides of the panel. This coating is chemically 
compatible with and simular in expansion coefficient to the 
mullite insulation. The coating provides the necessary 
, ' thermal control optical characteristics, rain erosion 

protection, and abrasion resistance for ground handling 
and atmospheric flight. 

« 

® RTV-560 adhesive - A silicone elastomer room- temperature-cured 

adhesive system used for both panel and pad bonding. 

Panel -to-panel gaps (0.12 to 0.25 inch) are sized to avoid 
CRSI panel compressive loads at maximum expansion during entry. The 
gaps are partially filled with a low-density-quartz expandable gasket 
to thermally protect the substructure at the base of the joint. 
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A panel self- venting system is provided which allows venting to the 
boundary layer pressure through the panel gaps. It consists of a 
local interruption in the panel to PD-200 bond line (adjacent to the 
lower outer edge.) A silicone primer, applied to the lower panel surface, 
provides a water barrier while allowing venting of internal gases. 

Two CRSI test prototypes, mounted on simulated air-frame structure 
and configured to two critical areas of the baseline system, have been 
successfully tested to withstand 100 orbiter thermal environment cycles. 
During the test series the prototypes were also subjected to a dynamic/ 
acoustic energy spectrum of 163 db for the equivalent of 25 missions. 

4 . 21.2 Elastomeric RSI 

. ERSI (ESM1004X) is used as the primary TPS on the orbiter 
upper surfaces where lower temperatures ( < 650°F) are experienced. 

Using an elastomer instead of a ceramic results in a TPS weight reduction 
of 3500 pounds. It is a flexible, open-cell structure material 
possessing good low- temperature flexural properties, and is attached 
to the airframe in coated sheets with RTV-560 bond. The ESM1004X 
is coated with an elastomeric silicone resin (for waterproofing) 
pigmented with titanium dioxide and carbon black (for thermal control). 

It is an impact-resistant, easily repairable material, which minimizes 
the susceptability to handling damage. 

The ESM1004X is similar to the material used on Minuteman 
reentry vehicle. Its thermal stability for 100 missions at 650°F has been 
demonstrated by tests. No difficulty is anticipated in extending its 
capacity to 500 missions. Excellent coating stability has been demonstrated 
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to peak temperatures of 750°F in a vacuum maintained below 500 microns. 

4.21.3 Reinforced Carbon-Carbon (RCC) 

Reinforced carbon-carbon (RCC) materials are used for wing leading 
edge and body nose cap applications. The RCC leading edge elements are 
approximately 30 inches long, with the radii variations illustrated. 

Adjacent elements are downstream-lapped for spanwise expansion capability 
and utilize common attachment points to the prime structure. The joints are 
designed for individual leading edge element removal for maintainability. 
Cross-radiation effects are used to reduce maximum temperature and associated 
thermal stress, wherever possible. High-temperature bulk insulation 
backs up the RCC- material to protect the structure. A silicone carbide 
oxidation inhibitor covers 100 percent of the RCC surface. The RCC 
vehicle body nose cap is simular to the leading edge in material details, 
construction, insulation, and attachment. The RCC material (and oxidation 
inhibitor) has been tested for 100 thermal cycles. 

4.21.4 Special TPS Areas 

4/21.4.1 *TPS Outer Window 

The TPS window employs a pane of fused silica (CGW 7940) 
to act as a heat shield. The windows, nominally 30 inches wide and 
30 inches high, are subjected to a maximum temperature of 1200°F. 

They are sealed with a wire-mesh core .jacketed with a woven ceramic 
cloth to prevent plasma impingement on internal structure. The outer 
window is part of a three-pane redundant system where the middle crew 
cabin window pane (fused silica for thermal protection) is also sealed 
to contain cabin pressure. The inner crew cabin pane is the primary 
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< 


pressure-containing window. 

4 <.21.4.2 Seal s 

State-of-the-are Apollo CSM seal materials are generally 
•ut-rl'i^ed • for --doors r and 'hatches . The eTevon 'requires the use of high- 
temperature metals in the seal contact area to ensure adequate abrasion 
resistance. The upper seal panel is titanium with a metallic mesh 
seal simular to the seals used on the X-15 aircraft. It consists of 
an Inconel 602 mesh encased in an Inconel foil sleeve. This concept 
was proven by test to be reusable for 100 missions at 1200 °F during 
Phase B development testing. There are no proven fully reusable seal concepts 
•for 1 800°F environments in the lower elevon seal area. The current 
approach is to use a woven quartz plasma shield upstream to protect 
the metallic mesh seal inside the cavity be reducing the seal temperature. 

An alternate internal flexible longitudinal total pressure may be used 
to preclude outer seal leakage. 

4*21.5 Rationale 

Not Required. 

4.21.6 Reference ! j ; j j j ; 

- 166 Pages 3-32 - 3-51 ;• 


Li. 
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Thermal Control System (TCS) 



The TCS basically .is passive and integrally deisgned with the 
TPS. It consists essentially of insulation (TG 15000) heat sinks 
and optical coatings, with local active elements as required to maintain 
vehicle compartments within allowable temperature limits. Where individual 
components require closer control (heaters, cold plates, etc.), details 

7 V 

are given in the applicable system description. FIGURE 4. 3-8-1 shows 
the salient features of the TCS which is similar to that used on the 
Apollo CSM . The various subsystem components have been grouped 
essentially in the cabin area and the aft equipment bay with the required 
insulation located along the basic structure. This arrangement 
maximizes energy exchange among the subsystem components and facilitates 
equipment maintainability. Maximum utilization of existing heat sources 
and sinks to minimize make-up heater requirements and to achieve a 
flexible TCS design. 

Thermal conditioning is most critical for the vehicle in high 
inclination orbits where the vehicle is placed in an adverse attitude 
that is maintained for a long period. This creates cold soak and hot soak 
conditions that may require special operation on the part of the crew. 

The cold soak condition results in temperatures that may go 
below the "glass-transition" temperature (-1 70°F) of the foamed pad 
and room-temperature-vulcanized (RTV) bond, thus causing a ductility 
loss and sensitivity to thermal and load deformation. There are two 
aspects of cold soak, both concerned with maintaining ceramic RSI 
attachment integrity. These occur during (a) on-orbit periods under no loads 
relating to a "no mission interrupt" for thermal conditioning design 
approach and (b) entry heating with initial low RSI bondline temperatures 
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relating to a "no attitude constraint" for thermal conditioning design 
approach. 


Hot soak is a related preentry thermal conditioning aspect. 
Internal subsystems that are sensitive to the hot-soak orbital condition 
are currently located in the vehicle fuselage, where temperatures are 
primarily influenced by the elastomeric RSI thermal control coating 
properties. As discussed, thermal coatings fot the elastomeric RSI which 
exhibit an a s /£: <=0.4 are already developed. 

4.22.1 Rationale 
Not fcequired. 

4.22.2 Reference 

166, .Pages 3-32 - 3-51 
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